MD-102 Protect devices Practice Question
Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that devices cannot access corporate email if they are rooted. What should you configure?
⚠ Common exam trap
The trap here is thinking that Conditional Access alone can detect rooted devices; it relies on compliance signals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A device compliance policy with the 'Rooted devices' setting set to 'Block'.
To block rooted Android devices from accessing corporate email, you need a compliance policy that marks rooted devices as non-compliant. Then, a Conditional Access policy can enforce compliance for email access. The compliance policy setting 'Rooted devices' set to 'Block' is the key configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A device compliance policy with the 'Rooted devices' setting set to 'Block'.
Why this is correct
In an Intune compliance policy for Android Enterprise, the 'Rooted devices' setting can be set to 'Block'. When a device is detected as rooted, it is marked non-compliant. You can then use Conditional Access to block access to corporate email and other resources. This directly enforces the requirement.
- ✗
An app protection policy that blocks jailbroken devices.
Why it's wrong here
App protection policies (MAM) can block access to corporate data within apps on jailbroken or rooted devices, but they do not apply to device-level email access via native clients. For device-wide email access, a compliance policy is required. This option only covers app-level data, not the entire device.
- ✗
A Conditional Access policy that requires a compliant device.
Why it's wrong here
A Conditional Access policy requiring a compliant device is necessary to enforce compliance, but it does not itself detect rooted devices. Without a compliance policy that flags rooted devices as non-compliant, the Conditional Access policy would not block them. This option is part of the solution but not sufficient alone.
- ✗
A device configuration profile that disables USB debugging.
Why it's wrong here
Disabling USB debugging can help prevent some unauthorized access, but it does not detect or block rooted devices. Rooting can be achieved without USB debugging, and this setting does not affect compliance or access to corporate email. It is not the appropriate control for detecting rooted devices.
Go deeper
Related to this question
Learn chapter
Configuring Compliance Policies
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
This MD-102 question is part of Courseiva's 556-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.