MD-102 Manage and maintain devices Practice Question
You are designing a Windows 365 Cloud PC provisioning policy. The requirement is that when a user is assigned a Cloud PC, it must automatically have Microsoft Defender for Endpoint configured with real-time protection enabled and a custom firewall rule allowing only specific IPs. Which approach should you use?
⚠ Common exam trap
The trap here is that candidates mistakenly think Windows 365 provisioning policies can include security configurations, but in reality, they only define infrastructure settings, while all post-provisioning management (including Defender and firewall rules) must be handled by Intune policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Intune device configuration profile using the Settings Catalog and assign it to the Azure AD group containing Cloud PC users.
Intune device configuration profiles using the Settings Catalog allow granular control over Microsoft Defender for Endpoint settings (e.g., real-time protection) and custom firewall rules. These profiles can be assigned to an Azure AD group containing Cloud PC users, ensuring the settings are applied automatically after provisioning via the Windows 365 service, which integrates with Intune for post-provisioning management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an Intune device configuration profile using the Settings Catalog and assign it to the Azure AD group containing Cloud PC users.
Why this is correct
Settings Catalog allows granular configuration of Defender and firewall settings.
- ✗
Include the settings in the Windows 365 provisioning policy.
Why it's wrong here
Provisioning policies define image, network, and licensing, not device configuration.
- ✗
Create a PowerShell script that runs during provisioning and apply it via Azure Automation.
Why it's wrong here
Scripts may not run at provisioning time and lack Intune's management capabilities.
- ✗
Use a Group Policy Object (GPO) applied via on-premises AD.
Why it's wrong here
Cloud PCs are not domain-joined by default; GPOs require hybrid Azure AD join and connectivity.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.