MD-102 Manage and maintain devices Practice Question
Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only devices with TPM 2.0 and Secure Boot enabled can access Microsoft 365 resources. What is the best approach?
⚠ Common exam trap
Many exam-takers think a Conditional Access policy alone can directly check hardware features, but it actually requires a compliance policy to report those attributes first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a device compliance policy requiring TPM and Secure Boot, and a Conditional Access policy to block non-compliant devices.
Device compliance policies in Microsoft Intune can evaluate hardware attributes like TPM version and Secure Boot status. When combined with a Conditional Access policy that blocks non-compliant devices, this enforces the security requirements before granting access to Microsoft 365 resources. This two-step approach ensures only devices meeting the hardware security baseline can authenticate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an app protection policy targeting Microsoft 365 apps.
Why it's wrong here
App protection policies don't check device hardware.
- ✗
Create a device configuration policy to enable TPM and Secure Boot.
Why it's wrong here
Configuration policies enable settings but don't block access.
- ✓
Create a device compliance policy requiring TPM and Secure Boot, and a Conditional Access policy to block non-compliant devices.
Why this is correct
This combination enforces the requirements and blocks access.
- ✗
Create a Conditional Access policy requiring TPM and Secure Boot.
Why it's wrong here
Conditional Access cannot directly check hardware; it relies on compliance status.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Secure boot
Secure Boot is a security feature that ensures a device starts up using only trusted software that is digitally signed by the manufacturer.
Key term
TPM
TPM (Trusted Platform Module) is a dedicated hardware chip on a computer's motherboard that stores cryptographic keys, passwords, and certificates to secure the system against unauthorized access and tampering.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.