MD-102 Protect devices Practice Question
You are the endpoint administrator for Contoso, a company with 5,000 Windows 11 devices managed by Microsoft Intune. The company uses Microsoft Defender for Endpoint (MDE) for endpoint detection and response. You need to implement a solution that ensures all devices have the latest Windows security updates installed within 7 days of release. Additionally, you must ensure that if a device misses two consecutive update cycles, it is automatically blocked from accessing corporate resources until it is updated. You have the following requirements: 1. Use Intune update rings to control update deployment. 2. Use MDE vulnerability management to identify missing updates. 3. Device compliance policies should check for missing updates and mark devices noncompliant. 4. Conditional Access should block noncompliant devices. Which combination of actions should you take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.
Configure an update ring with a 7-day deferral to ensure updates are installed within 7 days. Create a device compliance policy that checks for missing updates to mark devices as noncompliant. Configure Conditional Access to require compliant devices, blocking those that are noncompliant. Option A is incorrect because it uses an app protection policy instead of a device compliance policy. Option B is incorrect because it sets no deferral (deferral 0), which would apply updates immediately, not within 7 days as required. Option D is incorrect because it does not configure Conditional Access, so noncompliant devices would not be blocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure an update ring with a 7-day deferral. Create an app protection policy that requires minimum OS version. Assign the app protection policy to all users.
Why it's wrong here
App protection policy does not enforce update installation; it only checks OS version at app launch.
- ✗
Configure an update ring with no deferral (deferral 0). Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.
Why it's wrong here
No deferral means updates install immediately, not within 7 days; also, missing two cycles logic is not addressed.
- ✓
Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.
Why this is correct
Correct: updates are deferred 7 days; compliance checks missing updates; Conditional Access blocks noncompliant devices. The policy will mark devices noncompliant if they miss updates, and after two cycles (14 days) they will be blocked.
- ✗
Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Assign the compliance policy to all devices. Do not configure Conditional Access.
Why it's wrong here
Missing Conditional Access; noncompliant devices will not be blocked.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
Key term
App protection policy
An app protection policy is a set of rules that controls how data is handled and secured within mobile applications, ensuring corporate information stays safe even on personal devices.
About these practice questions
This MD-102 question is part of Courseiva's 942-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.