Practice Test GeeksMD-101 - Managing Modern Desktops Practice Test
← All MD-101 Flashcard Decks

Endpoint Security and Microsoft Defender for Endpoint Flashcards

6 cards from real MD-101 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 Endpoint Security and Microsoft Defender for Endpoint flashcards as text

  1. What is BitLocker Drive Encryption's primary security purpose on Windows devices?

    Answer: To protect data at rest from unauthorized access if the device is lost or stolen

    BitLocker encrypts the entire drive volume so that if a device is lost or stolen, the data remains inaccessible without the correct authentication or recovery key.

  2. Which Intune policy type configures BitLocker encryption requirements and recovery key escrow settings for Windows devices?

    Answer: Endpoint security — Disk encryption policy (BitLocker)

    Endpoint security Disk encryption policies in Intune configure full BitLocker settings including encryption method, recovery key escrow to Azure AD, and startup authentication.

  3. Where are BitLocker recovery keys stored when Intune BitLocker policy is configured to escrow keys to Azure AD?

    Answer: In the Intune device record accessible via the Azure AD device blade

    When BitLocker recovery key escrow is configured via Intune, keys are stored in the Azure AD device record and are accessible to admins in the Intune admin center.

  4. Which BitLocker authentication mode requires users to enter a PIN at startup before Windows loads?

    Answer: TPM + PIN mode

    TPM + PIN mode requires users to enter a PIN at pre-boot startup in addition to TPM validation, providing stronger protection against offline attacks.

  5. An Intune BitLocker policy sets encryption to 'XTS-AES 256-bit' for OS drives. A device reports BitLocker as pending encryption. What is a common cause?

    Answer: The device does not meet hardware requirements (no TPM 2.0)

    BitLocker silent encryption requires TPM 2.0; if the device lacks TPM 2.0 or it is disabled in firmware, BitLocker remains in a pending state and cannot encrypt silently.

  6. Which Intune feature provides a centralized way to rotate BitLocker recovery keys for a specific device?

    Answer: BitLocker key rotation via Device > Recovery keys > Rotate BitLocker keys in Intune

    Intune provides a 'Rotate BitLocker keys' device action that triggers the device to generate a new recovery key and escrow it back to Azure AD, invalidating the old key.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. learn.microsoft.com — Retake policy, passing score, fees, time limit, exam information · verified Oct 2026
  2. home.pearsonvue.com — Test delivery · verified Oct 2026
Endpoint Security and Microsoft Defender for Endpoint Flashcards — MD-101 Study Cards with Answers