MS-102 Microsoft 365 Administrator Expert Managing Intune and Device Compliance 3

Question 1

What is the key difference between Intune App Protection Policies (APP/MAM) and device compliance policies?

Accepted Answer

APP protects organizational data within apps without requiring device enrollment in Intune

Answer

APP applies only to Windows; compliance policies apply to all platforms

Answer

Compliance policies control app installs; APP controls device hardware settings

Answer

APP requires Azure AD Premium P2; compliance policies only require P1

Question 2

An organization wants to prevent users from pasting content from the corporate Outlook mobile app into a personal notes app on their iOS device. Which Intune feature should be configured?

Accepted Answer

App protection policy with data transfer restrictions

Answer

Device compliance policy for iOS

Answer

Conditional Access policy

Answer

Device configuration profile with app restrictions

Question 3

What is 'co-management' in the context of Microsoft Intune and Microsoft Endpoint Configuration Manager (MECM)?

Accepted Answer

Sharing device management workloads between Configuration Manager and Intune simultaneously

Answer

Managing both iOS and Android devices from a single Intune policy

Answer

Using two separate Intune tenants to manage different device groups

Answer

Enrolling the same device in Intune and a third-party MDM at the same time

Question 4

Which Microsoft Intune capability uses machine learning to provide insights into device startup performance, app reliability, and recommendations to improve end-user experience?

Accepted Answer

Endpoint analytics

Answer

Device compliance reports

Answer

Device health attestation

Answer

Microsoft Secure Score for Devices

Question 5

When an administrator performs a 'Fresh Start' remote action on a Windows 10/11 device in Intune, what is the outcome?

Accepted Answer

Windows is reinstalled, OEM pre-installed apps are removed, and user data can optionally be retained

Answer

The device is removed from Intune and Azure AD immediately

Answer

All apps are uninstalled but Windows settings are fully preserved

Answer

The device is wiped identically to the Full Wipe action

Question 6

Which Intune policy type should be used to configure Windows Defender Antivirus settings — such as real-time protection, cloud-delivered protection, and exclusions — on managed Windows 10/11 devices?

Accepted Answer

Endpoint security – Antivirus policy

Answer

Device compliance policy

Answer

Device configuration – Device restrictions profile

Answer

Windows Update for Business policy

Question 7

An administrator needs to require users to enter a PIN when accessing corporate apps managed by Intune on iOS after 30 minutes of inactivity. Where is this setting configured?

Accepted Answer

App protection policy – Access requirements

Answer

Device compliance policy for iOS/iPadOS

Answer

Device configuration profile – Device restrictions

Answer

Conditional Access policy – Session controls