MD-102 Prepare infrastructure for devices Practice Question
Your organization uses Microsoft Defender for Endpoint (now Microsoft Defender XDR) and Microsoft Intune. You need to ensure that devices that are deemed 'at risk' by Microsoft Defender for Endpoint are automatically blocked from accessing corporate resources. What should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A compliance policy that marks devices as noncompliant based on Defender for Endpoint risk, and a conditional access policy that blocks noncompliant devices.
To block devices at risk by Microsoft Defender for Endpoint from accessing corporate resources, you need to configure a compliance policy that evaluates the device risk level from Defender for Endpoint (using the 'Require the device to be at or under the Device Threat Level' setting) and marks devices as noncompliant if they exceed the threshold. Then, configure a Conditional Access policy that targets all cloud apps and uses the 'Grant' control to 'Require device to be marked as compliant', which will block noncompliant devices. This combination is exactly described in Option B. Option A is incorrect because an app protection policy controls access at the app level, not device level. Option C is incorrect because although it describes a similar setup, it does not explicitly state that the conditional access policy blocks noncompliant devices, and the order of configuration is reversed; the standard approach is option B. Option D is incorrect because a device configuration policy does not enforce access control; it configures device settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An app protection policy in Intune that blocks access based on device risk.
Why it's wrong here
An app protection policy controls access at the app level, not device level. It cannot block device access to corporate resources based on device risk.
- ✓
A compliance policy that marks devices as noncompliant based on Defender for Endpoint risk, and a conditional access policy that blocks noncompliant devices.
Why this is correct
Correct. This combination allows you to evaluate device risk via Defender for Endpoint in a compliance policy, then use Conditional Access to block noncompliant devices.
- ✗
A conditional access policy that requires device to be compliant, and a compliance policy that uses the Defender for Endpoint device risk level.
Why it's wrong here
This describes a similar approach but the order is reversed; however, the key action of blocking noncompliant devices is not explicitly stated, and the typical configuration is to first set the compliance policy then the conditional access policy. The exam expects option B as the correct answer.
- ✗
A device configuration policy that disables network access for at-risk devices.
Why it's wrong here
A device configuration policy configures device settings and cannot be used to enforce access control or block resources.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Device risk
Device risk is the chance that a computer, phone, or other endpoint could cause a security problem or data leak because it is not properly managed or protected.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.