Quick Answer
The answer is to configure an app protection policy for iOS/iPadOS. This is correct because app protection policies in Microsoft Intune provide granular, app-level encryption for corporate data at rest, ensuring that files and information stored within managed apps are secured independently of the device’s native encryption. On the MD-102 exam, this question tests your ability to distinguish between app-level and device-level controls—a common trap is confusing device compliance policies or configuration profiles with app protection, but only the latter encrypts data inside the app itself. Remember, iOS device-level encryption is always on, but it does not protect app-specific data from being accessed by other apps or after a device is compromised. A useful memory tip: think “APP” for App Protection Policy—it’s the only policy that encrypts data inside the app, not just on the device.
This MD-102 practice question tests your understanding of prepare infrastructure for devices. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Users have iOS/iPadOS devices enrolled in Intune. You need to ensure that corporate data in managed apps is encrypted at rest. What should you configure?
iOS native encryption feature
Why wrong: Device encryption does not cover managed app data specifically.
Compliance policy for iOS/iPadOS
Why wrong: Compliance policies check device health, not app data encryption.
App protection policy for iOS/iPadOS
MAM policies can encrypt app data.
Device configuration profile with encryption settings
Why wrong: Device profiles do not control app-level encryption.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
App protection policy for iOS/iPadOS
Option B is correct because app protection policies can enforce encryption of app data. Option A is wrong because compliance policies do not encrypt app data. Option C is wrong because device configuration profiles manage device settings, not app-level encryption. Option D is wrong because iOS itself encrypts at the device level, but not app-specific data.
Key principle: NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
iOS native encryption feature
Why it's wrong here
Device encryption does not cover managed app data specifically.
Compliance policy for iOS/iPadOS
Why it's wrong here
Compliance policies check device health, not app data encryption.
App protection policy for iOS/iPadOS
Why this is correct
MAM policies can encrypt app data.
Related concept
Static NAT maps one inside address to one outside address.
Device configuration profile with encryption settings
Why it's wrong here
Device profiles do not control app-level encryption.
Common exam traps
NAT is not only about the public address. The inside/outside interface roles and the ACL or rule that matches traffic are just as important.
Detailed technical explanation
NAT questions usually test address translation, overload/PAT behaviour, static mappings and whether the right traffic is being translated. Read the interface direction and address terms carefully.
Key takeaway
NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.
Real-world example
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Review the four NAT address types (inside local, inside global, outside local, outside global), PAT port overload, and static vs dynamic NAT use cases. Then practise related MD-102 NAT questions on configuration and troubleshooting.
Prepare infrastructure for devices — study guide chapter
Learn the concepts, then practise the questions
Prepare infrastructure for devices practice questions
Targeted practice on this topic area only
All MD-102 questions
991 questions across all exam domains
Microsoft 365 Endpoint Administrator MD-102 study guide
Full concept coverage aligned to exam objectives
MD-102 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise MD-102 questions linked to Prepare infrastructure for devices.
Practise MD-102 questions linked to Manage and maintain devices.
Practise MD-102 questions linked to Manage applications.
Practise MD-102 questions linked to Protect devices.
Practise MD-102 questions linked to Deploy Windows client.
Practise MD-102 questions linked to Manage identity and compliance.
Practise MD-102 questions linked to Manage, maintain, and protect devices.
Practise MD-102 questions linked to MD-102 fundamentals.
Practise MD-102 questions linked to MD-102 scenario.
Practise MD-102 questions linked to MD-102 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Prepare infrastructure for devices — This question tests Prepare infrastructure for devices — Static NAT maps one inside address to one outside address..
The correct answer is: App protection policy for iOS/iPadOS — Option B is correct because app protection policies can enforce encryption of app data. Option A is wrong because compliance policies do not encrypt app data. Option C is wrong because device configuration profiles manage device settings, not app-level encryption. Option D is wrong because iOS itself encrypts at the device level, but not app-specific data.
Review the four NAT address types (inside local, inside global, outside local, outside global), PAT port overload, and static vs dynamic NAT use cases. Then practise related MD-102 NAT questions on configuration and troubleshooting.
Static NAT maps one inside address to one outside address.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 21, 2026
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.