SC-100 Practice Question: Design solutions that align with security best practices and priorities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enforce a minimum PIN length on devices

  Why it's wrong here

  Requiring a longer PIN raises the bar for brute-force or guessing attempts, but it is an access control mechanism that does nothing to shield the actual data at rest if an attacker gains entry through a different vector or physically removes storage. When a device is lost, the data remains unencrypted unless other protections like BitLocker or FileVault are enabled; a PIN only delays unauthorized access, not not prevent data extraction if the storage is imaged or the PIN is compromised.

• ✓

  Configure a compliance policy that requires device encryption

  Why this is correct

  A compliance policy that mandates device encryption ensures that the storage medium (e.g., internal flash) is encrypted, typically using the hardware security module and a recovery key managed by the device, so that if the device is lost, the data is unreadable without the decryption key. This is a protective measure at rest; in addition, the compliance policy can trigger conditional access to block non-compliant devices, but the encryption itself is the core safeguard that prevents data exposure from physical access.

• ✓

  Deploy a selective wipe policy that removes corporate data

  Why this is correct

  A selective wipe, also known as a corporate wipe, can be triggered manually through the Intune portal or via a compliance policy action, and it removes all managed corporate apps, data, and configuration profiles from the device while preserving the user's personal data and applications. This is the most direct mitigation for a lost device because it actively erases the sensitive corporate content that could otherwise be exfiltrated, and it works even if the device is offline through the next time it checks in with the service.

• ✗

  Require app protection policies (MAM) for all apps

  Why it's wrong here

  App protection policies (MAM) are application-level controls that restrict copying, pasting, saving, or sharing of corporate data within protected apps and enforce app-level PINs; however, they do not encrypt the file system or remove data from the device when it is lost. Because the corporate data still resides in the app containers on the device, a determined attacker with physical access could potentially extract it, especially on a rooted or jailbroken device, so MAM alone fails to address the immediate need to secure data after device loss.

• ✗

  Enable jailbreak detection in a device compliance policy

  Why it's wrong here

  Jailbreak detection (or root detection) is a compliance check that identifies devices with modified operating systems or unlocked bootloaders and flags them as non-compliant, which then blocks them from accessing corporate email, documents, or cloud resources through conditional access. However, this is a proactive access-control measure that does not encrypt data, remove data, or secure the device after it is physically lost; an attacker who already has the device can still access data if encryption is disabled or the jailbreak gives them elevated privileges.

Go deeper

Related to this question