CCNA Protect Devices Questions

Even if the device is compliant, the conditional access policy may also require a specific client app or location. Option C is correct because the conditional access policy might have additional requirements like 'Require approved client app'. Option A is incorrect because the device is compliant.

Option B is incorrect because stale compliance is not the issue if it shows compliant. Option D is incorrect because the Company Portal app is not required for access.

Options A and D are correct. Intune can enforce minimum OS version and require encryption. Option B is wrong because Intune does not check for jailbreak on Android; that's for iOS.

Option C is wrong because Intune does not enforce screen lock type directly in compliance; it's a device restriction. Option E is wrong because Intune does not check for antivirus on Android.

The correct answer is to verify that the policy is not in a conflict state by using the Troubleshooting + support blade. Option A is incorrect because the policy is already assigned. Option B is incorrect because the enrollment restrictions are not related to Start layout.

Option D is incorrect because the update ring policy does not affect Start layout enforcement.

Option A is correct because Microsoft Defender for Cloud Apps can integrate with Microsoft Entra ID (Azure AD) to receive sign-in logs, which include IP address and location. Option B is wrong because Microsoft Sentinel is a SIEM, not a source of location data. Option C is wrong because Microsoft Purview is for compliance, not real-time access.

Option D is wrong because Intune enrollment logs do not contain app access location.

If the app is assigned as 'Required' but the device is not compliant, the app may not be available. Option A is correct because compliance policies can block app installation. Option B is incorrect because VPP tokens are for volume purchasing, not availability.

Option C is incorrect because the Company Portal app is separate. Option D is incorrect because iOS does not have an 'Unknown Sources' setting.

Option A is correct because the 'deviceHealth' condition with 'defenderSensorVersion' and 'defenderSensorHealth' is the correct syntax for conditional launch in Intune app protection policies. Option B is wrong because 'minimumVersion' is not a valid key. Option C is wrong because 'clientVersion' is used for the app itself, not the sensor.

Option D is wrong because the syntax is incorrect.

Option B is correct because the app must be assigned to the user or device group. Option A is wrong because the device is compliant. Option C is wrong because Android app approval status is not a common issue.

Option D is wrong because Company Portal is installed.

Option C is correct because BitLocker requires a TPM and if the device does not have one, encryption will not start. Option A is wrong because the policy is assigned correctly. Option B is wrong because the device is compliant.

Option D is wrong because BitLocker does not require a specific Windows edition for basic encryption.

Windows Update for Business settings are configured via device configuration profiles in Intune. Option B is correct because 'Windows Update for Business' is a profile type under 'Update Policies' or 'Device configuration - Windows Update'. Option A is incorrect because compliance policies are for compliance, not updates.

Option C is incorrect because app protection policies manage data protection. Option D is incorrect because endpoint security policies include antivirus, not update settings.

Option C is correct because Android Enterprise work profile creates a separate profile on the device that isolates work apps and data from personal apps. Option A is wrong because device administrator mode is legacy and does not provide strong separation. Option B is wrong because corporate-owned personally enabled (COPE) uses work profile but is for corporate-owned devices, not BYOD.

Option D is wrong because fully managed is for corporate-owned without personal space.

Option D is correct because tamper protection is configured via an endpoint protection profile for Microsoft Defender Antivirus. Option A is wrong because security baselines include some settings but tamper protection is specifically in endpoint protection. Option B is wrong because device configuration profiles do not include tamper protection.

Option C is wrong because compliance policies do not enforce settings.

Option A is correct because Microsoft Intune provides pre-built security baselines for Windows 10 that can be customized. Option B is wrong because Configuration Manager is on-premises and not the modern approach. Option C is wrong because Group Policy is not managed via Intune.

Option D is wrong because PowerShell scripts are not a baseline but can be used for custom configurations.

Option A is correct: Endpoint security disk encryption policy in Intune manages BitLocker settings. Option B (Device compliance policy) checks encryption status but doesn't enforce it. Option C (Device configuration profile) can include some encryption settings but the dedicated endpoint security policy is recommended.

Option D (App protection policy) manages data protection at the app level, not device encryption.

Option B is correct. App protection policies (MAM) protect data in apps without requiring device enrollment. Option A is for MDM.

Option C is for compliance. Option D is for device configuration.

The correct answer is B because the ESP profile can block device setup failure and force sign-in. Option A is wrong because blocking local installation is not directly related. Option C is wrong because blocking Windows Setup is not an ESP setting.

Option D is wrong because requiring compliance is separate from OOBE sign-in.

Options A and D are correct. Option A: Configuring automatic MDM enrollment via Group Policy enables automatic enrollment. Option D: Adding a user scope in Azure AD join enables automatic enrollment for users.

Option B is wrong because enabling Azure AD registration is for BYOD, not automatic enrollment. Option C is wrong because co-management requires existing Configuration Manager. Option E is wrong because the MDM user scope in Intune is configured in Azure AD, not Intune alone.

Option A is correct because if the device is marked as noncompliant (e.g., due to noncompliant app or OS), Conditional Access will block email access even if the profile is present. Option B is wrong because if the device is compliant, the profile is applied. Option C is wrong because MDM authority is typically set correctly.

Option D is wrong because an app protection policy is for MAM, not for email access via native mail app.

Option B is correct because the exhibit shows telemetryLevel set to '1 - Basic', but the user sees 'Full', indicating the policy is not applying. The most common cause is that the device is not properly enrolled or the policy assignment is missing. Option A is wrong because even if the user changed it, Intune should reapply the policy.

Option C is wrong because group policies can override Intune if they are configured. Option D is wrong because the exhibit does not mention Windows Defender.

Option B is correct because the exhibit shows 'storageRequireEncryption' is set to true, which requires encryption, but the device reports as compliant without BitLocker, indicating the setting is not enforced. Option A is wrong because password is required. Option C is wrong because the OS version is above the minimum.

Option D is wrong because the device reports compliant.

Option B is correct because the Enrollment Status Page (ESP) can block device use until required apps are installed. Option A is wrong because Autopilot profiles do not control app installation blocking. Option C is wrong because device compliance does not control app installation.

Option D is wrong because a PowerShell script is not the best method for this requirement and does not enforce blocking.

Option C is correct because the 'Minimum OS version' setting checks that the OS version is at least the specified value. Option A is wrong because 'Require' is not a version setting. Option B is wrong because 'Maximum OS version' allows versions up to a value, not above.

Option D is wrong because 'Exact OS version' requires a single version, not a minimum.

Option B is correct because custom detection rules are created using Advanced hunting queries. Option A is wrong because custom detection rules are not created with attack simulation training. Option C is wrong because Indicators of compromise are for blocking or allowing, not creating detection rules.

Option D is wrong because policies are for settings, not custom detections.

Option A is correct because a pending status often indicates that the device has not checked in recently. Option B is wrong because a certificate issue would show an error. Option C is wrong because incorrect time zone would not cause pending.

Option D is wrong because the device is connected and can sync, so network connectivity is not the issue.

Option D is correct because AppLocker rules are applied per user, not per device. If the policy is assigned to user groups but the user is not in the scope, the rules do not apply. Option A is wrong because AppLocker can be configured via OMA-URI.

Option B is wrong because AppLocker works on Windows 10/11 Enterprise and Education editions. Option C is wrong because uninstalling the app does not enforce rules.

Option A and Option C are correct. Autopilot Reset can be used to reapply a device to a new user and to quickly resolve device issues by resetting while keeping enrollment. Option B is wrong because Autopilot Reset does not provide a fresh OS image; it resets to a known good state.

Option D is wrong because Autopilot Reset is for existing devices, not for adding new devices. Option E is wrong because Autopilot Reset does not change the join type.

Option C is correct because 'allowDeviceUseOnInstallFailure' is set to false, so the device will be blocked from use if an installation fails. Option A is wrong because 'blockDeviceSetupRetryByUser' is true, meaning the user cannot retry. Option B is wrong because 'allowDeviceResetOnInstallFailure' is true, but that allows a reset, not a retry.

Option D is wrong because the timeout is 60 minutes, but the failure occurs within that period.

Option C is correct because the PassportForWork CSP's 'UseFIDO2' key, when set to 0 (disabled), prohibits FIDO2 keys while other policies enable WHfB. Option A is wrong because setting 'UseFIDO2' to 1 would allow FIDO2. Option B is wrong because 'EnableWindowsHelloForBusiness' enables WHfB but does not affect FIDO2.

Option D is wrong because setting 'RequireSecurityDevice' forces TPM but does not address FIDO2.

Option D is correct because if the app requires a specific device type (e.g., Windows 10) and the device is Windows 11, it might not be supported. Option A is wrong because the device is compliant. Option B is wrong because the app is assigned.

Option C is wrong because the device meets requirements.

Option C is correct. The 'Device threat level' compliance setting uses the Defender for Endpoint threat score to mark devices non-compliant. Option A is for integration enablement.

Option B is for non-compliance actions. Option D is for conditional access.

Option D is correct because 'Inactive' status often indicates that the sensor data is not being sent, which can be resolved by restarting the Microsoft Defender for Endpoint service. Option A is wrong because the issue is not with the onboarding script. Option B is wrong because modifying a policy is not needed for activation.

Option C is wrong because reinstallation is excessive.

Options A, C, and D are correct. A session policy requires a template (or action), an app filter, and a session control type. Option B is wrong because device groups are not part of session policy.

Option E is wrong because Conditional Access policies are separate from session control templates.

Option B is correct. RiskScore 0 means no risk detected. Option A is wrong because 0 does not indicate vulnerability.

Option C is wrong because it is not unknown. Option D is wrong because risk score applies to devices.

Options B and D are correct: Intune supports server management via endpoint security policies; Group Policy is on-premises method. Option A (Microsoft Store) is not for servers. Option C (Windows Update) does not install Defender for Endpoint.

Option E (ConfigMgr) is also valid but not listed as correct here; only two correct answers.

Option C is correct because the Company Portal app on the device might be outdated, causing it to not display the app correctly. Option A is wrong because the user is assigned the app. Option B is wrong because the device is compliant.

Option D is wrong because the app is assigned.

The policy requires encryption of removable drives as well (bitLockerRemovableDrivesEncryptionRequired). If the user has a USB drive that is not encrypted, the device will be non-compliant. Option C is correct.

Option A is incorrect because the policy does not require a specific TPM version. Option B is incorrect because the system drive is encrypted. Option D is incorrect because recovery password rotation does not affect compliance.

The correct answer is App protection policy (MAM). Option A is incorrect because compliance policies apply to devices, not apps. Option B is incorrect because configuration profiles set device settings.

Option D is incorrect because enrollment restrictions control device enrollment.

Options B, C, and D are correct. You must enable Windows Hello for Business, configure minimum PIN length, and configure biometrics if desired. Option A is wrong because certificate enrollment is separate.

Option E is wrong because it's not a setting.

Option D is correct because the Microsoft Defender for Endpoint portal provides detailed incident investigation tools, including the attack timeline and initial access vector. Option A is wrong because Event Viewer alone lacks the context of Defender detections. Option B is wrong because Intune compliance reports do not contain threat data.

Option C is wrong because Sysinternals is not integrated with Microsoft 365 Defender.

The correct answer is Update ring policy. Option A is incorrect because compliance policies do not manage updates. Option B is incorrect because configuration profiles can set update settings but update rings are the recommended method.

Option D is incorrect because application protection policies are for mobile app management.

A trusted TPM and a key trust model are required. Option A is correct because Windows Hello for Business requires a TPM for hardware-based key protection. Option B is correct because the key trust model is one of the trust models required for deployment.

Option C is incorrect because Azure AD Premium P1 is not required. Option D is incorrect because certificate-based authentication is optional. Option E is incorrect because the Company Portal is not required for configuration.

Option B is correct because a certificate issue could prevent the email profile from working. Option A is wrong because device compliance is fine. Option C is wrong because the issue is specific to one user.

Option D is wrong because the email profile is deployed.

Option C is correct because Conditional Access policies can require a PIN for access to resources. Option A is wrong because compliance policies do not enforce PIN requirements. Option B is wrong because device configuration policies are for device settings, not access policies.

Option D is wrong because app protection policies are for mobile app management.

The correct answers are A and C. Option B is incorrect because app protection policies are not used for device risk. Option D is incorrect because conditional access is not a component of threat detection.

Option E is incorrect because device compliance policy evaluates compliance but does not increase risk score automatically.

Option A is correct because setting the app as 'Required' and making it 'Removable' = No will prevent removal. Option B is wrong because 'Available' allows removal. Option C is wrong because 'Uninstall' is not an assignment type.

Option D is wrong because 'Block removal' is not an assignment setting.

Option B is correct because Conditional Access can enforce device compliance for cloud apps like Exchange Online. Option A is wrong because App Protection Policies are for mobile apps, not Outlook desktop. Option C is wrong because Compliance Policies alone don't enforce access; they need Conditional Access.

Option D is wrong because device enrollment is a prerequisite, not the enforcement mechanism.

Option B is correct because if Windows Update for Business is disabled on the devices, the update ring will not apply. Option A is wrong because the ring is assigned. Option C is wrong because the deferral period is set correctly.

Option D is wrong because the group might be correct.

Option C is correct because device restrictions include passcode policies and wipe settings for iOS. Option A is wrong because compliance policies only mark devices as non-compliant, they do not enforce passcode settings. Option B is wrong because device configuration profiles are a general category, but the specific settings are within device restrictions.

Option D is wrong because app protection policies are for app-level data protection.

Options B, C, and D are correct. Microsoft Defender for Endpoint on macOS consists of the main daemon (wdavdaemon), the user interface agent, and the kernel extension (or system extension) for real-time protection. Option A is wrong because Microsoft Endpoint Configuration Manager agent is not required for macOS.

Option E is wrong because Microsoft Intune management extension is for Windows, not macOS.

Option A is correct because app protection policies (MAM) allow selective wipe of corporate data without affecting personal data. Option B is wrong because full wipe removes all data. Option C is wrong because compliance policy does not provide selective wipe.

Option D is wrong because device restrictions do not provide wipe capabilities.

Option A is correct because the JSON shows 'moderateSeverity': 'quarantine'. To change it to 'clean', modify the defenderDetectedMalwareActions setting. Option B is wrong because scan type does not affect actions.

Option C is wrong because schedule does not affect actions. Option D is wrong because it is not a global setting.

Option C is correct because the sensor can become disconnected if malware is interfering; running a scan can detect and remove it. Option A is wrong because the issue is not enrollment. Option B is wrong because reinstallation is excessive.

Option D is wrong because macOS does not have a Windows Security app.

Options B and D are correct: Device compliance policy defines health requirements; Conditional Access enforces compliance. Option A (Intune enrollment) is a prerequisite but not an access control. Option C (App protection policy) protects data, not device health.

Option E (Autopilot) is for provisioning.

Microsoft Defender for Endpoint can integrate with Intune to remediate threats. Option D is correct because you can create an automated investigation and remediation policy in MDE that triggers a remediation action on Intune-managed devices. Option A is incorrect because compliance policies can mark non-compliant but not automatically update.

Option B is incorrect because update rings require manual assignment. Option C is incorrect because endpoint security policies do not automatically apply updates.

Option A and C are correct. Option A resets the compliance state to force re-evaluation. Option C triggers a sync to apply any pending policies.

Option B is for BitLocker issues. Option D is for device wipe.

Options A, B, and D are correct. To enforce BitLocker with TPM and store recovery key in Entra ID, you need to enable BitLocker, configure TPM as protector, and specify Entra ID as the recovery key storage. Option C is wrong because encryption of OS drive is a separate setting.

Option E is wrong because the encryption method does not affect recovery key storage.

Option D is correct because the Conditional Access policy must target all cloud apps, including Exchange Online. Option A is wrong because the policy can apply to all users. Option B is wrong because the policy applies to device platforms.

Option C is wrong because the policy should be set to 'Require device to be marked as compliant'.

Option D is correct because BitLocker requires a system partition that is active and has sufficient space. Option A is incorrect because all devices have TPM 2.0. Option B is incorrect because Secure Boot is not required for BitLocker policy to apply.

Option C is incorrect because the devices are already enrolled, and enrollment restrictions are not the issue.

Option D is correct: Update rings set the deferral period to 7 days; a device compliance policy checks for missing updates and marks noncompliant; Conditional Access blocks noncompliant devices. Option A (compliance policy on missing updates only) misses the Conditional Access block. Option B (app protection policy) is irrelevant.

Option C (update ring with deferral 0) applies updates immediately, not within 7 days.

Option A is correct because the profile must be assigned to the correct group; if the devices are not in the group, the policy won't apply. Option B is wrong because the setting is correct. Option C is wrong because iOS restrictions are applied at the device level, not user.

Option D is wrong because device compliance is not relevant here.

The correct answer is Every 8 hours. Option A is incorrect because 30 minutes is too short and not default. Option B is incorrect because 1 hour is not default.

Option D is incorrect because 24 hours is not default.

Option B is correct because compliance policies in Intune are evaluated based on the last check-in time; if a device hasn't checked in recently, its status may be outdated. Option A is wrong because a reboot is not required for compliance evaluation. Option C is wrong because BitLocker status is reported correctly if enabled.

Option D is wrong because OS build version reporting is accurate.

Options A and C are correct. Autopilot requires devices to have a valid Windows license and be registered in Microsoft Entra ID. Option B is wrong because Azure AD is now Microsoft Entra ID, but the requirement is for the device to be registered, not for the tenant to be premium.

Option D is wrong because Autopilot does not require on-premises Active Directory. Option E is wrong because a Microsoft 365 E3 license is not a prerequisite; a Windows license is sufficient.

The correct answer is Conditional Launch policies, which can require a minimum device health score before allowing access. Option A is incorrect because compliance policies check device compliance but do not trigger remediation actions automatically. Option B is incorrect because configuration profiles set settings but do not respond to MDE alerts.

Option D is incorrect because Windows Update for Business manages updates, not remediation.

Option A is correct. Setting AllowTelemetry to 0 disables telemetry data collection. Option B is wrong because value 1 enables basic telemetry.

Option C is wrong because 0 is not invalid. Option D is wrong because it targets device context.

Option B is correct because the 'Remove device from organization' action in Microsoft Defender XDR triggers deletion of the device's data from the service. Option A is wrong because disabling the onboarding policy only stops future data collection. Option C is wrong because uninstalling the sensor does not remove existing data.

Option D is wrong because there is no 'Data Purge' action for individual devices.

Azure AD Join and Autopilot are valid enrollment methods. Option A is correct because Azure AD Join is a standard enrollment. Option B is correct because Windows Autopilot is a zero-touch enrollment method.

Option C is incorrect because 'Device enrollment manager' is a role, not a method. Option D is incorrect because 'Bulk enrollment' is not a method but a process using provisioning packages. Option E is incorrect because 'Apple Business Manager' is for iOS/macOS.

The correct answer is Enrollment restrictions. Option A is incorrect because compliance policies do not block enrollment. Option C is incorrect because conditional access works after enrollment.

Option D is incorrect because device categories are for grouping, not blocking enrollment.

Option D is correct because Microsoft Defender for Endpoint can be configured to require approval for remediation actions. Option A is wrong because automated investigation runs automatically. Option B is wrong because allowing all actions without approval is not desired.

Option C is wrong because disabling automated investigation is not required.

Attack surface reduction, next-generation protection, and endpoint detection and response are core features. Option A is correct because attack surface reduction rules reduce vulnerabilities. Option B is correct because next-generation protection includes antivirus.

Option C is correct because EDR detects and responds to threats. Option D is incorrect because 'Conditional access' is a Microsoft Entra ID feature. Option E is incorrect because 'Data loss prevention' is a Microsoft Purview feature.

Options B, D, and E are correct. Quality update deferral period (B) and feature update deferral period (D) set the number of days to wait before offering updates. Quality update deadline (E) forces installation within a set number of days after the update is offered.

Option A is wrong because 'Quality update pause' halts updates. Option C is wrong because 'Feature update uninstall period' controls how long users can roll back, not installation.