MD-102 Practice Test 32 — 15 Questions

Question 1

You are designing a Windows Autopilot deployment for a global organization. Devices are purchased from multiple OEMs and shipped directly to users. Some users report that their devices do not register in Autopilot automatically. You confirm the devices have Windows 11 Pro preinstalled and meet hardware requirements. What is the most likely reason for the registration failure, and what should you do to resolve it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The devices are not registered in Autopilot by the OEM; collect the hardware hash using a script. The most likely reason is that the OEM did not register the devices in Windows Autopilot by uploading their hardware hashes to the Microsoft Partner Center. Without this registration, the devices will not be recognized during OOBE and will not automatically receive the Autopilot deployment profile. To resolve this, you must collect the hardware hash from each device using a PowerShell script (e.g., Get-WindowsAutopilotInfo.ps1) and manually upload it to Intune or the Partner Center.

Answer

The devices have a TPM chip that is not compliant with Autopilot requirements

Answer

The Autopilot deployment profile is assigned to a dynamic device group that excludes these devices

Answer

The devices are not connected to the internet during OOBE

Question 2

Your organization requires that all corporate laptops be encrypted. You manage Windows 10 devices with Microsoft Intune. Which policy should you configure?

Accepted Answer

Create a BitLocker policy in Intune Endpoint Protection.. Microsoft Intune's Endpoint Protection policy includes a dedicated BitLocker settings section that allows administrators to enforce encryption on Windows 10 devices. This policy centrally manages BitLocker drive encryption, recovery key escrow to Microsoft Entra ID, and encryption method (e.g., XTS-AES 128-bit), meeting the requirement for corporate laptop encryption.

Answer

Enable Device Encryption in Windows settings.

Answer

Configure a FileVault policy for Windows devices.

Answer

Deploy an Encrypting File System (EFS) policy.

Question 3

An organization uses Microsoft Intune to manage Windows devices. They need to configure a policy to enforce disk encryption on devices. Which TWO of the following are valid encryption options?

Accepted Answer

BitLocker. BitLocker (A) is correct because it is Microsoft's full-volume disk encryption feature for Windows and is the primary encryption method configured through Intune disk encryption policies. Device encryption (C) is also correct because it is a Windows feature (available on supported devices, often with Modern Standby and a Microsoft account) that Intune can enforce via the same disk encryption policy profile. EFS (B) is not a valid answer here because it encrypts individual files and folders on NTFS volumes rather than enforcing full disk encryption. FileVault (D) is incorrect because it is Apple's macOS disk encryption technology, not a Windows encryption option. APFS encryption (E) is incorrect because APFS is an Apple file system and its encryption applies to macOS/iOS devices, not Windows devices managed by Intune.

Answer

Encrypting File System (EFS)

Answer

FileVault

Answer

APFS encryption

Question 4

Refer to the exhibit. You are reviewing a Windows 10 update ring configuration JSON. What does the 'automaticUpdateBehavior' setting control?

Accepted Answer

Whether updates are installed automatically and if the user can control reboot timing. The 'automaticUpdateBehavior' setting in a Windows 10 update ring configuration JSON controls whether updates are downloaded and installed automatically, and whether the user can control reboot timing. When set to 'autoInstallAndRebootWithNoUserControl', updates install automatically and reboots occur without user interaction; when set to 'autoInstallAndRebootWithUserControl', the user can schedule or postpone reboots. This directly matches option C, as it governs both automatic installation and reboot control.

Answer

The level of update notifications

Answer

How long to defer feature updates

Answer

The branch readiness level

Question 5

A user reports that their Windows 11 device is not receiving compliance policies from Microsoft Intune. The device shows as 'Not evaluated' in the Microsoft Intune admin center. Which step should you take first to resolve the issue?

Accepted Answer

On the device, go to Settings > Accounts > Access work or school, select the account, and click Sync.. When a Windows 11 device shows 'Not evaluated' in Intune, it usually means the MDM enrollment is intact but the device hasn't checked in with the Intune service recently. Manually triggering a sync from Settings > Accounts > Access work or school forces the MDM client to pull the latest compliance policies immediately, which is the least disruptive first step.

Answer

Disconnect the device from Microsoft Entra ID and rejoin.

Answer

Delete and recreate the compliance policy in Microsoft Intune.

Answer

Re-enroll the device in Microsoft Intune.

Question 6

You have a Windows 10 device running OS version 10.0.19043.1234. The device is compliant with all settings except password requirements. The device does not have a password set. What is the compliance status?

Accepted Answer

Noncompliant because passwordRequired is true and no password set.. The device is noncompliant due to the passwordRequired policy setting being set to true while no password is configured on the device. In Microsoft Intune, compliance policies evaluate each setting independently; if a required setting like passwordRequired is not met, the device is marked noncompliant regardless of other compliant settings. The OS version 10.0.19043.1234 is within a supported range, and storage encryption is not evaluated unless explicitly required by a policy, so only the missing password triggers noncompliance.

Answer

Noncompliant because storage encryption is not enabled.

Answer

Noncompliant because OS version is not within range.

Answer

Compliant

Question 7

You need to deploy a line-of-business (LOB) iOS app to company-owned devices using Microsoft Intune. The app is signed with an enterprise certificate. Which deployment method should you use?

Accepted Answer

iOS/iPadOS LOB app.. An iOS/iPadOS LOB app deployment in Intune is specifically designed for line-of-business apps that are signed with an enterprise certificate and distributed internally. This method allows you to upload the .ipa file directly to Intune and deploy it to company-owned devices without requiring the Apple App Store or a Volume Purchase Program.

Answer

Managed Browser app.

Answer

iOS/iPadOS store app.

Answer

Volume Purchase Program (VPP) app.

Question 8

A company is implementing Windows Hello for Business and wants to use certificate-based authentication. They have an on-premises Active Directory and are using Azure AD Connect for hybrid identity. Which prerequisites must be met to support certificate-based Windows Hello for Business?

Accepted Answer

An enterprise certification authority (CA) must be deployed and all devices must be Azure AD joined or hybrid Azure AD joined.. Certificate-based Windows Hello for Business requires an enterprise PKI to issue and validate certificates for authentication. Devices must be Microsoft Entra ID joined or hybrid Microsoft Entra ID joined to enroll these certificates and support the certificate trust model. On-premises Active Directory and Microsoft Entra Connect provide the hybrid identity foundation, but the CA and appropriate device join state are the critical prerequisites.

Answer

All users must have the Microsoft Authenticator app installed.

Answer

Conditional Access policies must be configured to require Windows Hello for Business.

Answer

All users must be configured for passwordless sign-in.

Question 9

An organization uses Microsoft Intune to manage Windows devices. They want to ensure that only devices with a TPM 2.0 chip can access corporate email. Which policy should be configured?

Accepted Answer

Device compliance policy with a condition for TPM 2.0, combined with a conditional access policy. A device compliance policy can evaluate whether a device has TPM 2.0 (via the TPM specification version check), and when combined with a Conditional Access policy, it can block access to corporate email for non-compliant devices. This is the standard Microsoft approach for enforcing hardware-based security requirements for cloud app access.

Answer

Device enrollment restriction to require TPM 2.0

Answer

Device configuration profile to enable TPM 2.0

Answer

App protection policy to require TPM 2.0

Question 10

Which TWO are benefits of using Windows Autopilot for device provisioning? (Select two.)

Accepted Answer

Allows IT to provision devices remotely without physical access.. Option C is correct because Windows Autopilot lets IT provision and configure devices remotely through the cloud (Microsoft Intune/Endpoint Manager), so administrators never need to touch the hardware or maintain a staging network. Option D is correct because Autopilot uses the OEM-installed Windows image and applies configuration via Intune profiles and the Enrollment Status Page, eliminating the traditional wipe-and-load imaging and manual configuration steps. Options A, B, and E are not benefits of Autopilot: it requires internet connectivity to reach Intune and Microsoft Entra ID, it deliberately uses the existing OEM image rather than deploying custom images (that is what MDT/ConfigMgr imaging does), and although the Out-of-Box Experience is largely automated, the user still must sign in and may complete some steps, so it does not eliminate all user interaction.

Answer

Works offline without internet connectivity.

Answer

Enables deployment of custom operating system images.

Answer

Eliminates the need for any user interaction during setup.

Question 11

You are reviewing a custom device configuration profile in Intune. The exhibit shows an OMA-URI setting. What is the purpose of this setting?

Accepted Answer

Disables the camera on the lock screen. The OMA-URI setting ./Vendor/MSFT/Policy/Config/DeviceLock/PreventLockScreenCamera is used to disable the camera on the Windows lock screen. This policy prevents users from accessing the camera while the device is locked, enhancing security by mitigating privacy risks such as unauthorized camera use. It does not affect camera functionality once the user logs in.

Answer

Enables the camera on the lock screen

Answer

Disables the camera on the device entirely

Answer

Disables the microphone on the lock screen

Question 12

You need to enroll a Windows 11 device into Microsoft Intune using a work or school account. The device is already joined to Microsoft Entra ID. What is the simplest enrollment method?

Accepted Answer

Automatic enrollment via Microsoft Entra join. When a Windows 11 device is already Microsoft Entra joined, the simplest enrollment path is automatic MDM enrollment via the Entra join process. During the Entra join, if the user's license includes Intune and the MDM user scope is configured in the Entra ID Mobility settings, the device is automatically enrolled into Intune without any additional user action. This is the least-effort method because it requires no additional configuration on the device itself.

Answer

Windows Autopilot

Answer

Group Policy to configure enrollment

Answer

Manual enrollment using the Company Portal

Question 13

You assign a required app to a device group. After the next sync, some devices report a 'Failed' status. What should you check first?

Accepted Answer

The device management log. The device management log (also known as the Intune management extension log or the MDM agent log on the device) provides detailed, real-time error codes and failure reasons for app installation attempts. When a required app shows 'Failed' status after sync, this log is the first place to check because it captures the exact cause—such as a download failure, dependency issue, or script execution error—that the Intune console cannot surface in summary views.

Answer

The device's last sync time

Answer

If a newer version is already installed

Answer

Whether the user is licensed

Question 14

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that some required applications are not being installed on their devices. You confirm the applications are assigned as 'Required' to a device group, and the devices are online. What is the most likely cause?

Accepted Answer

The Intune Management Extension is missing. The Intune Management Extension is required to process Win32 app installations. If the extension is missing or not running, required apps will not install even though the device is online and assignment is configured. Option A is wrong because BitLocker encryption status does not affect app installation. Option B is wrong because device-targeted assignments do not require the user to be logged in. Option C is wrong because the enrollment status page does not block required app installations after enrollment is complete.

Answer

BitLocker encryption is pending

Answer

The user is not logged in to the device

Answer

The enrollment status page is blocking installation

Question 15

You are configuring Conditional Access for device compliance. You have an Intune compliance policy that requires a minimum OS version. You create a Conditional Access policy that grants access only when devices are marked as compliant. However, some users can still access corporate email from non-compliant devices. What is the most likely reason?

Accepted Answer

The Conditional Access policy does not include the email application as a target.. A Conditional Access policy must include at least one cloud app as a target. If the corporate email application (e.g., Exchange Online) is not included in the policy, the policy will not apply to access attempts for that app, allowing non-compliant devices to connect. Option A is incorrect because a 'Block' policy would block access, not allow it. Option B is incorrect because the policy's user scope does not affect whether the app is targeted. Option C is incorrect because while compliance policy assignment is important, the most direct reason is the missing app target.

Answer

The Conditional Access policy is set to 'Block' instead of 'Grant'.

Answer

The Conditional Access policy applies only to users in a specific group.

Answer

The compliance policy is not assigned to the users' devices.