MD-102 Protect devices Practice Question
You manage a set of Windows 11 devices with Microsoft Intune. You need to configure attack surface reduction (ASR) rules to block Office applications from creating child processes. You want to ensure the rules are enforced and cannot be bypassed by users. Which Intune profile type should you use?
⚠ Common exam trap
The trap here is assuming that any configuration profile that mentions ASR or endpoint protection will suffice, but the dedicated Attack surface reduction policy is the only one that provides full enforcement and management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Endpoint security > Attack surface reduction policy
The Attack surface reduction policy in Intune is the correct choice for configuring ASR rules. It provides a dedicated, user-friendly interface to set rules to Block, Audit, or Warn. When set to Block, the rules are enforced by Defender Antivirus and cannot be overridden by users, ensuring the desired protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Devices > Compliance policies
Why it's wrong here
Compliance policies are used to evaluate device conditions, not to configure security settings. They cannot enforce ASR rules; they can only report whether a device meets a condition. If an ASR rule is not applied, the compliance policy would not be able to block the action. Thus, it is not the correct tool.
- ✓
Endpoint security > Attack surface reduction policy
Why this is correct
The Attack surface reduction policy under Endpoint security in Intune is specifically designed to configure and enforce ASR rules. It provides a streamlined interface to set rules to Block, Audit, or Warn. When set to Block, the rules are enforced by Defender Antivirus and cannot be disabled by users, meeting the requirement.
- ✗
Devices > Configuration profiles > Templates > Endpoint protection
Why it's wrong here
The Endpoint protection template under Configuration profiles does include some ASR settings, but it is not the dedicated ASR policy. It may offer limited configuration and is not as comprehensive or up-to-date as the Attack surface reduction policy. For full enforcement and management, the dedicated policy is recommended.
- ✗
Devices > Configuration profiles > Templates > Custom
Why it's wrong here
A custom profile requires you to manually enter OMA-URI settings for ASR rules. While this can work, it is more complex and error-prone. It does not provide the guided experience or validation of the dedicated ASR policy. This method is typically used for settings not available in built-in profiles.
Go deeper
Related to this question
Learn chapter
Updating Devices with Windows Update for Business
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Attack surface reduction
Attack surface reduction is a set of security practices that minimizes the number of ways an attacker can access or exploit a system by removing unnecessary features, locking down configurations, and controlling software behavior.
About these practice questions
One of 556 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.