Endpoint Security & Device Management Flashcards

Which Microsoft 365 service is the primary Mobile Device Management (MDM) and Mobile Application Management (MAM) solution for managing and securing endpoints?

Answer: Microsoft Intune

Microsoft Intune is the cloud-based MDM/MAM solution in Microsoft 365 used to manage and secure devices and apps.

What is the primary purpose of a Device Compliance Policy in Microsoft Intune?

Answer: To define rules that devices must satisfy to be considered compliant

Device Compliance Policies define health and security rules (e.g., OS version, encryption, PIN) that devices must meet to be considered compliant.

Which Microsoft Defender for Endpoint capability allows a security analyst to isolate a compromised device from the network while keeping the management channel active?

Answer: Network Isolation (Contain Device)

Network Isolation (Contain Device) cuts off all network connections except the Defender for Endpoint management channel, keeping investigative access intact.

When an Intune-managed device is marked as non-compliant, what typically happens when Conditional Access policies are enforced?

Answer: The user is blocked from accessing corporate resources

Conditional Access evaluates compliance status and blocks non-compliant devices from accessing corporate resources such as Exchange Online and SharePoint.

Which hardware security component does Microsoft Intune use for Windows device health attestation to verify the integrity of the boot process?

Answer: Trusted Platform Module (TPM)

The Trusted Platform Module (TPM) stores cryptographic measurements of the boot process, which Intune uses to attest that a device booted securely.

Which Windows provisioning feature in Microsoft 365 automates the out-of-box experience to join devices to Azure AD and enroll them in Intune without IT imaging?

Answer: Windows Autopilot

Windows Autopilot uses pre-registered hardware IDs to automatically configure and enroll devices into Azure AD and Intune during first boot.

Which Apple enrollment mechanism, integrated with Apple Business Manager, allows IT to automatically enroll corporate-owned iOS/iPadOS devices into Intune before they reach end users?

Answer: Automated Device Enrollment (formerly DEP)

Automated Device Enrollment (ADE), formerly Device Enrollment Program (DEP), allows zero-touch enrollment of Apple devices directly through Apple Business Manager.