Chapter 3 of 5 · Microsoft MD-102

Protect devices

Endpoint security policies, attack surface reduction, Defender for Endpoint, updates and Autopatch.

  • 6topics
  • 30 minfast track
  • 1diagrams and exhibits
  • 15–20%of the exam
Start with Antivirus, Disk Encryption and Firewall Policies

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Antivirus, Disk Encryption and Firewall PoliciesMD-102 endpoint security: Intune antivirus policies and exclusions, BitLocker and FileVault disk encryption with recovery keys…5 min
  2. 2Attack Surface Reduction, Security Baselines and App ControlMD-102 hardening: attack surface reduction rule modes, Intune security baselines and versions, and App Control for Business with…5 min
  3. 3Defender for Endpoint Integration and OnboardingMD-102 Defender for Endpoint: connect it to Intune, onboard devices with EDR policies, use device risk in compliance, and…5 min
  4. 4Windows Update Rings, Feature and Quality UpdatesMD-102 Windows updates: plan update rings with deferrals and deadlines, feature update policies, quality updates, expedite…Diagram5 min
  5. 5Autopatch, Hotpatch and Delivery OptimizationMD-102 managed updates: Windows Autopatch groups and rings, Hotpatch requirements and policy, and Delivery Optimization download…5 min
  6. 6Apple, Android Update Policies and Update MonitoringMD-102 other platform updates: Apple update policies with the settings catalog and DDM, Android updates with configuration…5 min

About this chapter

What this chapter covers

Enrolled devices still need protection and patches. This domain is worth 15 to 20 percent of the exam. It covers the endpoint security policies in Intune (antivirus, encryption, firewall, attack surface reduction, baselines and App Control for Business), the integration with Microsoft Defender for Endpoint, and the update tools for Windows, Apple and Android devices.

Questions ask which policy type or update control gives the right result, and how to roll changes out safely.

How the topics fit together

Hardenantivirus, encryption, firewallReduce attack surfaceASR, baselines, App ControlDetect and respondDefender for EndpointPatchrings, Autopatch, updates
  • Antivirus, disk encryption and firewall policies covers the core endpoint security policies.
  • Attack surface reduction, security baselines and App Control covers hardening.
  • Defender for Endpoint integration and onboarding covers connecting and onboarding devices.
  • Windows update rings, feature and quality updates covers Windows Update for Business controls.
  • Autopatch, Hotpatch and Delivery Optimization covers managed updates and download efficiency.
  • Apple, Android update policies and update monitoring covers non Windows updates and reporting.
Exam tip

Audit first, then enforce. Many questions reward the safe rollout step, such as audit mode, a pilot ring or a staged assignment.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with examples and tables.
  • What to remember for the exam: the facts to memorise and how questions are phrased.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Ready for more practice?

The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.