MD-102 Practice Test 25 — 15 Questions

Question 1

Order the steps to migrate user profiles from Windows 10 to a new device using User State Migration Tool (USMT).

Accepted Answer

1. Run ScanState on source computer, 2. Install Windows 10 on new device, 3. Run LoadState on new device, 4. Verify migration. ScanState collects data, specify store, install new OS, LoadState restores, then verify.

Answer

1. Install Windows 10 on new device, 2. Run ScanState on source computer, 3. Run LoadState on new device, 4. Verify migration

Answer

1. Run ScanState on source computer, 2. Run LoadState on new device, 3. Install Windows 10 on new device, 4. Verify migration

Answer

1. Run ScanState on source computer, 2. Install Windows 10 on new device, 3. Verify migration, 4. Run LoadState on new device

Question 2

A company plans to deploy Windows 11 to 500 devices using Microsoft Deployment Toolkit (MDT). The deployment must support UEFI-based devices with Secure Boot enabled. During a pilot deployment, several devices fail to boot after deployment. You suspect the issue is related to the boot image configuration. Which boot image setting should you verify?

Accepted Answer

Ensure the boot image is set to x64 UEFI. UEFI-based devices with Secure Boot require a 64-bit boot image because UEFI firmware does not support legacy BIOS boot modes. Selecting an x64 UEFI boot image ensures the deployment environment is compatible with Secure Boot and GPT disk partitioning, which are mandatory for Windows 11 on UEFI systems. An incorrect boot image type (e.g., BIOS-based) will cause boot failures on UEFI-only hardware.

Answer

Ensure the boot image is set to x64 BIOS

Answer

Ensure the boot image is set to x86 BIOS

Answer

Ensure the boot image includes the WinPE optional component for Secure Boot

Question 3

A user reports that their Windows 10 device is not receiving policies from Microsoft Intune. The device shows as 'Not compliant' in the Intune console. You run the Get-MgDeviceManagementManagedDevice cmdlet and see that the device is enrolled and appears in the list. However, the LastSyncTime is 14 days ago. What is the most likely cause?

Accepted Answer

The Intune Management Extension service is not running on the device.. The Intune Management Extension (IME) service is responsible for synchronizing policies, including compliance and configuration policies, from Intune to Windows 10 devices. If the IME service is not running, the device will not receive new policies or sync status, leading to a stale LastSyncTime (14 days ago) and a 'Not compliant' state, even though the device is enrolled and appears in the Get-MgDeviceManagementManagedDevice output.

Answer

The MDM certificate has expired.

Answer

The device is not connected to the internet due to a proxy misconfiguration.

Answer

The device is not enrolled in Intune.

Question 4

You are reviewing a Windows 10 compliance policy in Microsoft Intune. A user with a device running Windows 10 version 20H2 (build 19042.985) reports that the device is marked as non-compliant. The device has a password of length 8, a PIN with 4 characters, Secure Boot enabled, BitLocker enabled, and Windows Defender Firewall active. What is the most likely reason for non-compliance?

Accepted Answer

The device uses a PIN with only 4 characters, which does not meet the minimum password length of 6.. The device uses a PIN with only 4 characters, which does not meet the minimum password length of 6. In Intune compliance policies for Windows 10, the 'Minimum password length' setting applies to both passwords and PINs. A PIN of 4 characters violates this requirement, causing non-compliance even if other settings like BitLocker and Secure Boot are properly configured.

Answer

Windows Defender Firewall is not active.

Answer

Secure Boot is not enabled on the device.

Answer

The OS build number 19042.985 is below the required minimum version 19041.0.

Question 5

Arrange the steps to troubleshoot a BitLocker recovery key prompt on a Windows 10 device.

Accepted Answer

Step 1: Identify the cause of the prompt, Step 2: Retrieve the BitLocker recovery key, Step 3: Enter the recovery key to unlock the drive, Step 4: Address the root cause to prevent recurrence.. The correct order for troubleshooting a BitLocker recovery key prompt is to first identify the cause (e.g., TPM change, PIN reset), then retrieve the recovery key from its stored location (e.g., Azure AD, Microsoft account), enter it to unlock the drive, and finally address the root cause to prevent recurrence. This sequence ensures a logical progression from diagnosis to resolution without unnecessary steps.

Answer

Step 1: Identify the cause of the prompt, Step 2: Address the root cause to prevent recurrence, Step 3: Retrieve the BitLocker recovery key, Step 4: Enter the recovery key to unlock the drive.

Answer

Step 1: Retrieve the BitLocker recovery key, Step 2: Enter the recovery key to unlock the drive, Step 3: Identify the cause of the prompt, Step 4: Address the root cause to prevent recurrence.

Answer

Step 1: Address the root cause to prevent recurrence, Step 2: Identify the cause of the prompt, Step 3: Retrieve the BitLocker recovery key, Step 4: Enter the recovery key to unlock the drive.

Question 6

A company manages 500 Windows 10 devices using Microsoft Intune. They plan to upgrade to Windows 11. The IT team wants to ensure that only devices meeting the Windows 11 hardware requirements are allowed to upgrade. They need to block the upgrade on devices that do not meet the requirements, and provide a clear error message to users. What should the IT team configure?

Accepted Answer

Configure a Windows 11 readiness policy in Intune and assign it to all devices.. A Windows 11 readiness policy in Intune is specifically designed to evaluate device hardware compatibility against Windows 11 requirements and block the upgrade on non-compliant devices while displaying a custom error message to users. This policy uses the Windows Health Monitoring and the TPM 2.0 attestation checks to enforce the hardware requirements before the upgrade can proceed.

Answer

Configure a feature update policy for Windows 10 and Windows 11 in Intune.

Answer

Create a compliance policy with Windows 11 requirements and assign it to all devices.

Answer

Use a device configuration profile to set the 'TargetReleaseVersion' policy for Windows 11.

Question 7

Refer to the exhibit. A Windows 10 device is showing as non-compliant. The compliance policy 'Require BitLocker' is assigned to all devices. The device does not have BitLocker enabled. However, the user is able to access corporate email on the device. What is the most likely reason for this?

Accepted Answer

There is no Conditional Access policy that requires compliant device for access to corporate email.. D is correct because compliance policies alone do not enforce access restrictions; they only report device compliance status. To block access to corporate email, a Conditional Access policy must be configured to require a compliant device. Without such a policy, the device can still access email even if it is non-compliant.

Answer

The compliance policy has a grace period of 7 days for BitLocker.

Answer

The compliance policy is not assigned to the device.

Answer

The device is configured as a kiosk device, which exempts it from compliance.

Question 8

A multinational organization uses Microsoft 365 E5 licenses. The compliance officer wants to ensure that all documents containing credit card numbers are automatically classified and protected with a label that applies encryption. You configure auto-labeling policies in Microsoft Purview. After 24 hours, the compliance officer reports that no documents have been labeled. The policy scope is set to 'All locations' and the policy is enabled. What is the most likely cause of the issue?

Accepted Answer

The policy is deployed in simulation mode only.. Auto-labeling policies in Microsoft Purview can be configured in simulation mode, which evaluates documents against the policy rules and reports what would be labeled without actually applying any labels. Since the compliance officer reports that no documents have been labeled after 24 hours, the most likely cause is that the policy is still in simulation mode, which is a common deployment step to validate the policy before turning it on for real labeling.

Answer

No sensitivity labels have been published to the users.

Answer

Auto-labeling requires Azure Information Protection (AIP) add-on license.

Answer

The priority of the policy is too low compared to other policies.

Question 9

You are deploying Microsoft Defender for Endpoint to Windows 10 devices managed by Microsoft Intune. After onboarding, you need to verify that the sensor is running. Which cmdlet should you use on the device?

Accepted Answer

Get-Service -Name Sense. The correct cmdlet is Get-Service -Name Sense because the Microsoft Defender for Endpoint sensor runs as a Windows service named 'Sense' (Microsoft Defender Advanced Threat Protection Service). Checking this service confirms the sensor is installed and running, which is the standard verification step after onboarding devices to Defender for Endpoint.

Answer

Get-Service -Name WinDefend

Answer

Get-DefenderEndpoint

Answer

Get-MpComputerStatus

Question 10

A company uses Configuration Manager to deploy Windows 11. During the deployment, several devices fail with error code 0x80070002. The administrator suspects the issue is related to missing boot images or content distribution. What should the administrator do first to resolve the issue?

Accepted Answer

Verify that the boot image and OS image are distributed to all distribution points.. Error code 0x80070002 translates to 'The system cannot find the file specified.' In a Configuration Manager task sequence deployment, this typically indicates that the boot image or OS image content is not available on the distribution point that the client is accessing. Verifying distribution ensures the required content is present and accessible, which is the most direct and common fix for this error.

Answer

Increase the client cache size on the affected devices.

Answer

Check the driver packages in the task sequence.

Answer

Recreate the task sequence with new OS image.

Question 11

A company uses Microsoft Intune to manage iOS devices. The administrator configures a device compliance policy that requires a minimum OS version of 15.0. Users report that devices running iOS 14.8 are marked non-compliant even after updating to iOS 15.0. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune after the update. The most likely cause is that the device has not checked in with Intune after the update. Intune relies on periodic check-ins to evaluate compliance; if the device updated to iOS 15.0 but hasn't completed a check-in, Intune still sees the last reported OS version (14.8) and marks it non-compliant. A forced sync or waiting for the next scheduled check-in resolves this.

Answer

The compliance policy requires a grace period

Answer

The update was not applied successfully

Answer

The compliance policy is not assigned to the correct user group

Question 12

You manage a Microsoft 365 tenant with 10,000 users. You are planning a Conditional Access policy to require MFA for all users. However, you need to ensure that users who have not yet registered for MFA are not blocked. What should you do to handle unregistered users?

Accepted Answer

Enable the Azure AD Identity Protection MFA registration policy to require users to register for MFA within 14 days.. The Azure AD Identity Protection MFA registration policy automatically enforces MFA registration for all users within a specified grace period (default 14 days), ensuring that users who have not yet registered are prompted to register before being blocked by a Conditional Access policy. This policy works in conjunction with Conditional Access by pre-registering users, so when the CA policy requiring MFA is enabled, all users already have MFA credentials available, preventing lockout.

Answer

Configure the Conditional Access policy in 'Report-only' mode to identify unregistered users.

Answer

Exclude all users who have not registered for MFA from the Conditional Access policy.

Answer

Create a separate Conditional Access policy that requires MFA only for users who have not registered for MFA.

Question 13

A company plans to deploy Windows 11 to 500 new devices using Microsoft Deployment Toolkit (MDT). The devices have various hardware configurations. The deployment must include language packs and regional settings. Which deployment method should the administrator use to minimize manual intervention?

Accepted Answer

Create a custom task sequence in MDT that includes language packs and regional settings.. MDT allows the administrator to create a custom task sequence that integrates language packs and regional settings directly into the deployment process. This approach automates the entire deployment with minimal manual intervention, as the task sequence handles all configuration steps without requiring post-deployment adjustments.

Answer

Use Windows Configuration Designer to create a provisioning package with language settings.

Answer

Create a task sequence in Configuration Manager without MDT integration.

Answer

Use Windows Autopilot with a custom profile to deploy language packs.

Question 14

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users accessing the company's SaaS applications. However, they need to exclude a group of service accounts that use legacy authentication protocols. What is the recommended approach?

Accepted Answer

Create a Conditional Access policy targeting all cloud apps, requiring MFA, and excluding the service accounts group.. Conditional Access is the recommended method for granular MFA enforcement in Microsoft Entra ID P1. It allows you to target all cloud apps (including SaaS applications) with a 'Require MFA' grant control and exclude a specific group of service accounts. This approach supports legacy authentication protocols by excluding those accounts, while Security defaults or per-user MFA would either block legacy auth or lack the necessary exclusion granularity.

Answer

Enable Security defaults and add the service accounts group to the excluded users list.

Answer

Assign the 'Require MFA' baseline policy and exclude the service accounts group.

Answer

Enable per-user MFA and exclude the service accounts group.

Question 15

A company uses Microsoft Intune to manage iOS/iPadOS devices. The compliance policy requires a minimum OS version of 15.0. A user reports that their iPad running iOS 14.8 cannot access company email and shows as non-compliant. However, the device is up to date with the latest available OS for that hardware. What should you do to allow the device to access email while maintaining security?

Accepted Answer

Configure a compliance grace period of 30 days on the policy.. A compliance grace period allows the device to remain non-compliant for a specified duration (e.g., 30 days) without immediately blocking access to company resources. This gives the user time to update the OS if possible, but since the iPad hardware cannot go beyond iOS 14.8, the grace period still permits email access while the device is marked non-compliant, maintaining security by not permanently exempting the device.

Answer

Change the minimum OS version to 14.8 in the policy.

Answer

Delete the compliance policy that requires iOS 15.0.

Answer

Request the user to update the iPad to iOS 15.0.