MD-102 Managing Device and Data 2 — Questions and Answers

Question 1: Which Intune feature enforces BitLocker encryption on Windows devices and can store the recovery key in Azure AD?

Endpoint security Disk encryption policy (Correct answer)
Device compliance Encryption required setting
Device configuration Device restrictions
Conditional access Require encryption

Correct answer: Endpoint security Disk encryption policy

The Endpoint security Disk encryption policy in Intune enforces BitLocker on Windows devices and can be configured to automatically back up the recovery key to Azure AD.

Intune Endpoint security Disk encryption policies provide dedicated settings for enforcing BitLocker on Windows devices, including drive encryption requirements, startup authentication methods, and recovery key escrow to Azure AD. When the recovery key is escrowed, administrators can retrieve it from the Intune device blade if a user is locked out. Device compliance policies can check whether a device is encrypted but cannot enforce or configure BitLocker settings themselves.

Question 2: What is Microsoft Entra ID Conditional Access, and what is a common use case for it in endpoint management?

A VPN technology for securing remote access
A policy engine that grants or blocks resource access based on conditions like device compliance and user identity (Correct answer)
A certificate authority for issuing device certificates
A tool for monitoring user activity in Microsoft 365

Correct answer: A policy engine that grants or blocks resource access based on conditions like device compliance and user identity

Conditional Access is a policy-based engine in Microsoft Entra ID that evaluates signals like device compliance, user risk, and location to decide whether to grant or block access to resources.

Conditional Access policies in Microsoft Entra ID evaluate signals such as user identity, device compliance state from Intune, sign-in risk, location, and application sensitivity to make real-time access decisions. A common endpoint management use case is requiring that only Intune-compliant devices can access Microsoft 365 apps, effectively blocking personal or non-enrolled devices from accessing corporate data. It integrates tightly with Intune compliance policies.

Question 3: An administrator wants to prevent users from copying corporate data from Microsoft 365 apps to personal apps on Windows devices. Which Intune feature addresses this?

App protection policies (MAM) (Correct answer)
Device compliance policy
Endpoint security Firewall policy
Device configuration Device restrictions

Correct answer: App protection policies (MAM)

App protection policies (Mobile Application Management) in Intune can restrict data transfer between managed apps and unmanaged personal apps, preventing corporate data leakage.

Intune App Protection Policies (MAM) define rules about how corporate data can be accessed and shared within and between apps. For Windows, they can restrict actions like cut, copy, and paste between managed and unmanaged apps, block saving corporate data to personal storage, and require a PIN to access managed apps. MAM policies can be deployed without full device enrollment, making them useful for BYOD scenarios where full device management is not appropriate.

Question 4: Which tool is used to migrate user files and settings from an old Windows device to a new one during a PC refresh or replacement?

Windows Easy Transfer
USMT (User State Migration Tool) (Correct answer)
OneDrive Known Folder Move
Robocopy

Correct answer: USMT (User State Migration Tool)

The User State Migration Tool (USMT) is Microsoft's enterprise tool for capturing and restoring user profiles, files, and application settings during PC migrations and OS upgrades.

USMT consists of two main tools: ScanState captures user state from the source device and LoadState restores user state to the target device. It can migrate user profiles, documents, desktop settings, application configurations, and more, using customisable XML rules. For modern deployments, OneDrive Known Folder Move is increasingly replacing USMT for cloud-managed environments, but USMT remains relevant for complex on-premises migrations.

Question 5: Which Microsoft Defender feature provides a centralised view of security alerts, threats, and recommendations for managed endpoints?

Microsoft Defender for Endpoint portal (Correct answer)
Microsoft Defender Antivirus dashboard
Windows Security app
Intune Endpoint security overview

Correct answer: Microsoft Defender for Endpoint portal

The Microsoft Defender for Endpoint portal at security.microsoft.com provides a unified security operations view with device inventory, alerts, threat analytics, vulnerability management, and attack surface reduction recommendations.

Microsoft Defender for Endpoint (MDE) is an enterprise endpoint detection and response (EDR) platform. Its portal at security.microsoft.com provides a single console for viewing security alerts across all onboarded devices, investigating incidents, running advanced threat hunting queries, managing vulnerability findings, and configuring attack surface reduction rules. Intune Endpoint security provides access to some of the same data but MDE's own portal offers deeper investigation capabilities.

Question 6: An administrator needs to remotely remove all corporate data from a user Windows device while leaving personal data intact. Which Intune action achieves this?

Retire (Correct answer)
Wipe (full factory reset)
Delete
Fresh Start

Correct answer: Retire

The Retire action in Intune removes corporate-managed apps, policies, and data from a device while leaving personal data and settings intact, making it suitable for BYOD offboarding.

Intune's Retire action performs a selective wipe, removing corporate data, apps deployed via Intune, email profiles, VPN and Wi-Fi profiles, and device compliance policies while preserving the user's personal data. This is appropriate for when an employee leaves the company but the device is personal (BYOD). The full Wipe action performs a factory reset, removing all data including personal content, and is appropriate for corporate-owned devices being redeployed or decommissioned.

MD-102 Managing Device and Data 2

Which Intune feature enforces BitLocker encryption on Windows devices and can store the recovery key in Azure AD?