CCNA Protect Devices Questions — Page 3 of 3

151

MCQhard

Your organization uses Microsoft Intune to manage Windows 11 devices. You notice that some devices are not receiving security updates even though update rings are assigned. What is the most likely cause?

A.Devices are noncompliant and blocked from receiving updates

B.Devices are not enrolled in Intune

C.Update ring policy has a deferral period configured that delays updates

D.Devices are not connected to the internet

AnswerC

Deferral periods can significantly delay update installation.

Why this answer

Update ring policies in Microsoft Intune include a deferral period setting that delays the installation of updates for a specified number of days after Microsoft releases them. If a deferral period is configured (e.g., 30 days for feature updates or 7 days for quality updates), devices will not receive security updates until that period expires, even though the update ring is assigned. This is a common configuration to allow testing before broad deployment, but it can mistakenly be overlooked when troubleshooting missing updates.

Exam trap

The trap here is that candidates often assume missing updates are due to compliance or connectivity issues, but the MD-102 exam specifically tests the understanding that deferral periods in update rings can delay security updates even when the policy is correctly assigned.

How to eliminate wrong answers

Option A is wrong because noncompliant devices are not blocked from receiving security updates; Intune can still deliver updates to noncompliant devices, though compliance policies may restrict access to corporate resources. Option B is wrong because the question states that devices are managed by Intune and have update rings assigned, which implies they are enrolled; if they were not enrolled, they would not appear in Intune at all. Option D is wrong because if devices were not connected to the internet, they would not be able to communicate with Intune or Windows Update, but the question specifies that update rings are assigned and the issue is specifically about security updates not being received, not a complete lack of connectivity.

Practice this question →

152

MCQmedium

Your company uses Microsoft Intune to manage iOS devices. You have an app protection policy that requires a PIN to access corporate data. Users report that they can access corporate data without entering a PIN after the first time. You want to ensure that the PIN is required every time the app is opened. What should you configure?

A.Set 'Require PIN to access' to 'Yes'.

B.Require device PIN instead of app PIN.

C.Set 'PIN reset after number of hours' to 0.

D.Set 'Timeout' to 1 minute.

AnswerC

0 forces PIN entry every time.

Why this answer

Setting 'PIN reset after number of hours' to 0 forces the user to enter a PIN every time the app is opened, regardless of whether they previously entered it. Option A is incorrect because 'Require PIN to access' is already set to 'Yes' but does not control PIN frequency; the PIN can be cached for a session. Option B is incorrect because requiring a device PIN instead of an app PIN changes the authentication method, but the issue is about requiring the app PIN on every open, not changing to device PIN.

Option D is incorrect because 'Timeout' controls how long the app can be inactive before requiring a PIN, not upon initial app launch.

Practice this question →

153

MCQmedium

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that all devices have a passcode of at least 6 characters and that devices are updated to the latest iOS version. You create a compliance policy. After assigning the policy, some devices are marked as non-compliant even though they have a passcode. What is the most likely cause?

A.The devices have multiple compliance policies applied.

B.iOS devices do not support compliance policies.

C.The devices have not checked in with Intune since the policy was assigned.

D.The policy was assigned to a user group instead of a device group.

AnswerC

Devices need to check in to receive and report compliance status.

Why this answer

Intune compliance policies are evaluated only when devices check in with the service. If a device has not performed a check-in since the policy was assigned, it will not have received or evaluated the new policy, and its compliance status will remain based on the previous state. The check-in interval for iOS/iPadOS devices is typically every 8 hours, but can be forced manually by the user.

Until the device checks in, it cannot be marked compliant even if it meets the passcode and OS version requirements.

Exam trap

The trap here is that candidates assume compliance policies are evaluated immediately upon assignment, but Intune requires a device check-in to apply and evaluate the policy, and devices that haven't checked in will show as non-compliant even if they meet the requirements.

How to eliminate wrong answers

Option A is wrong because having multiple compliance policies does not inherently cause a device to be marked non-compliant; Intune evaluates all assigned policies and the device is compliant only if it meets all of them. Option B is wrong because iOS/iPadOS devices fully support compliance policies in Intune, including passcode and OS version requirements. Option D is wrong because assigning a compliance policy to a user group is the standard and supported method; Intune applies the policy to all devices owned by users in that group, and this does not cause false non-compliance.

Practice this question →

154

MCQmedium

Your company uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft 365 apps is protected even if a device is compromised. Which App Protection Policy setting should you configure?

A.Configure device compliance policy to require jailbreak detection.

B.Configure App Protection Policy with 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' set to Policy managed apps.

C.Configure device configuration profile to require device PIN.

D.Configure App Protection Policy to require app PIN.

AnswerB

This restricts data transfer to managed apps only.

Why this answer

App Protection Policies (APP) in Microsoft Intune provide data protection at the application layer, independent of device management. By setting 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' to 'Policy managed apps', corporate data in Microsoft 365 apps is prevented from leaking to unmanaged or compromised apps, even if the device itself is jailbroken or otherwise compromised. This ensures data remains protected regardless of the device's security state.

Exam trap

The trap here is that candidates often confuse device-level controls (like compliance policies or device PINs) with app-level data protection, mistakenly believing that blocking access or requiring authentication is sufficient to protect corporate data on a compromised device, when in fact only App Protection Policies that restrict data movement can prevent data exfiltration.

How to eliminate wrong answers

Option A is wrong because device compliance policies with jailbreak detection are device-level controls that can block access or trigger conditional access, but they do not protect corporate data within apps if the device is already compromised; they only prevent access from non-compliant devices. Option C is wrong because a device configuration profile requiring a device PIN enforces device-level authentication but does not restrict data movement between apps or protect data within Microsoft 365 apps on a compromised device. Option D is wrong because requiring an app PIN via App Protection Policy adds an authentication layer to the app but does not control data transfer or copy/paste behavior, leaving corporate data vulnerable to exfiltration from a compromised device.

Practice this question →

155

MCQmedium

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with a Trusted Platform Module (TPM) version 2.0 and Secure Boot enabled can access corporate email. What should you configure?

A.Create a compliance policy with device health rules.

B.Configure Windows Hello for Business with TPM requirement.

C.Create a conditional access policy that requires compliant device.

D.Create a device configuration policy to enable Secure Boot.

AnswerA

Correct. A compliance policy with device health rules can require TPM 2.0 and Secure Boot, ensuring devices meet hardware security requirements.

Why this answer

To ensure devices meet TPM 2.0 and Secure Boot requirements, create an Intune compliance policy with device health rules. This policy evaluates device health and marks devices compliant only when they meet the configured hardware requirements. Windows Hello for Business (Option B) is a passwordless sign-in method and does not restrict corporate email access based on Secure Boot or TPM.

Option C is incorrect because a conditional access policy only enforces an existing compliance state and does not define the TPM/Secure Boot health rules. Option D is incorrect because a device configuration policy applies settings but does not enforce compliance for accessing corporate email.

Exam trap

Do not choose a conditional access policy as the direct configuration for TPM and Secure Boot requirements. Conditional access can require a compliant device, but the hardware health rules must be defined in a compliance policy.

Practice this question →