MD-102 Protect devices Practice Question
Your organization uses Microsoft Defender for Endpoint (now part of Defender XDR) and Intune. You need to create a device compliance policy that triggers automatic remediation when a device has a 'Medium' severity alert from Defender. Which setting should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure 'Device threat level' to 'Medium' and mark as noncompliant
The 'Device threat level' compliance policy setting in Intune uses the Defender for Endpoint (Defender XDR) alert severity to mark devices as noncompliant. Setting it to 'Medium' means devices with a medium or higher alert will be flagged. Additional actions can then be triggered via noncompliance actions. Option B is a generic noncompliance action that does not specifically target medium alerts. Option C is a Conditional Access policy, which is separate from compliance policies and would not trigger automatic remediation via Intune compliance. Option D refers to a different, deprecated setting (Machine Risk Score) not used in current Intune compliance policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure 'Device threat level' to 'Medium' and mark as noncompliant
Why this is correct
This uses Defender's threat level to enforce compliance.
- ✗
Set 'Noncompliance action' to 'Mark device noncompliant'
Why it's wrong here
Noncompliance actions are separate from the threat level evaluation.
- ✗
Create a Conditional Access policy to block devices with medium alerts
Why it's wrong here
Conditional Access can be used but the compliance policy must first mark the device noncompliant.
- ✗
Enable 'Require the device to be at or under the Machine Risk Score'
Why it's wrong here
This is not a valid setting name.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
XDR
XDR, or Extended Detection and Response, is a unified security platform that collects and correlates data across multiple security layers—endpoints, networks, servers, cloud workloads, and email—to improve threat detection and enable faster response.
Key term
Device compliance
Device compliance is the process of ensuring that a device meets an organization's security and configuration policies before it can access network resources.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.