MD-102 Protect devices Practice Question
Your organization uses Microsoft Intune to manage Windows 11 devices. You need to ensure that only devices with a Trusted Platform Module (TPM) version 2.0 and Secure Boot enabled can access corporate email. What should you configure?
⚠ Common exam trap
Do not choose a conditional access policy as the direct configuration for TPM and Secure Boot requirements. Conditional access can require a compliant device, but the hardware health rules must be defined in a compliance policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a compliance policy with device health rules.
To ensure devices meet TPM 2.0 and Secure Boot requirements, create an Intune compliance policy with device health rules. This policy evaluates device health and marks devices compliant only when they meet the configured hardware requirements. Windows Hello for Business (Option B) is a passwordless sign-in method and does not restrict corporate email access based on Secure Boot or TPM. Option C is incorrect because a conditional access policy only enforces an existing compliance state and does not define the TPM/Secure Boot health rules. Option D is incorrect because a device configuration policy applies settings but does not enforce compliance for accessing corporate email.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a compliance policy with device health rules.
Why this is correct
Correct. A compliance policy with device health rules can require TPM 2.0 and Secure Boot, ensuring devices meet hardware security requirements.
- ✗
Configure Windows Hello for Business with TPM requirement.
Why it's wrong here
Correct. Windows Hello for Business establishes a trust model (key or certificate) and uses TPM for key protection, providing device authentication alongside hardware enforcement.
- ✗
Create a conditional access policy that requires compliant device.
Why it's wrong here
Incorrect. A conditional access policy that requires a compliant device relies on existing compliance policies but does not directly enforce TPM or Secure Boot; it only checks compliance status.
- ✗
Create a device configuration policy to enable Secure Boot.
Why it's wrong here
Incorrect. A device configuration policy can enable Secure Boot but does not enforce the requirement before access; compliance policies are needed for enforcement.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
Key term
TPM
TPM (Trusted Platform Module) is a dedicated hardware chip on a computer's motherboard that stores cryptographic keys, passwords, and certificates to secure the system against unauthorized access and tampering.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.