Practice Test GeeksMD-101 - Managing Modern Desktops Practice Test
← All MD-101 Flashcard Decks

Conditional Access and Compliance Policies Flashcards

6 cards from real MD-101 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 Conditional Access and Compliance Policies flashcards as text

  1. A Conditional Access policy is set to 'Report-only' mode. What effect does it have on users?

    Answer: It evaluates the policy and logs what would have happened without enforcing any controls

    Report-only mode evaluates Conditional Access policies and records results in sign-in logs without enforcing any grant or session controls on users.

  2. Which Intune compliance setting specifically checks that Secure Boot is enabled on Windows devices?

    Answer: Require Secure Boot to be enabled on the device

    The 'Require Secure Boot to be enabled on the device' compliance setting verifies that the device's firmware security feature is active.

  3. What is the difference between 'Mark device non-compliant' immediately vs. with a delay in compliance policy actions?

    Answer: Immediate marking blocks access right away; delayed marking uses the grace period before CA enforcement

    Marking non-compliant immediately triggers Conditional Access enforcement at once, while scheduling it with a delay creates a grace period before access is blocked.

  4. An organization wants to block access from legacy authentication clients (e.g., SMTP, IMAP) to prevent credential spray attacks. What should be configured?

    Answer: Conditional Access policy blocking legacy authentication via client apps condition

    A Conditional Access policy targeting 'Other clients' in the Client apps condition and using Block access blocks legacy authentication protocols that don't support MFA.

  5. Which Conditional Access session control limits what users can do in a cloud app without blocking access entirely?

    Answer: Session control — Use Conditional Access App Control via Microsoft Defender for Cloud Apps

    Conditional Access App Control via Microsoft Defender for Cloud Apps allows session-level controls like blocking download, copy/paste, or print within cloud apps.

  6. What is the effect of the 'Require password change' Conditional Access grant control when user risk is high?

    Answer: Forces the user to reset their password via self-service password reset before gaining access

    The 'Require password change' grant control forces high-risk users to complete a secure SSPR password reset before they can access resources.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. learn.microsoft.com — Retake policy, passing score, fees, time limit, exam information · verified Oct 2026
  2. home.pearsonvue.com — Test delivery · verified Oct 2026