MD-102 Practice Test 46 — 15 Questions

Question 1

Your organization uses Microsoft Intune for device management. You have a compliance policy that requires Windows devices to have BitLocker enabled. A user reports that their device is marked as non-compliant even though BitLocker is turned on. What is the most likely cause?

Accepted Answer

The BitLocker recovery key is not escrowed to Microsoft Entra ID. Option B is correct because the compliance policy often checks for the recovery key being escrowed to Entra ID, not just encryption. Option A is wrong because TPM is checked but not the primary issue. Option C is wrong because BitLocker on OS drive is required. Option D is wrong because version compatibility is usually not the issue.

Answer

BitLocker is only enabled on data drives, not the system drive

Answer

The device is running a version of Windows that does not support BitLocker

Answer

The device does not have a TPM chip

Question 2

Your company plans to deploy Microsoft 365 Apps to 500 devices using Microsoft Intune. You want to ensure that the Office suite is installed with only Word, Excel, and PowerPoint. Which approach should you use?

Accepted Answer

Use Microsoft Intune to deploy Office by configuring a Win32 app with the Office Deployment Tool and a custom XML.. Option A is correct because the Office Deployment Tool allows you to configure which products are installed via an XML configuration file. Option B is incorrect because the Click-to-Run tool is part of the ODT but not the primary method. Option C is incorrect because Intune itself does not install Office without an XML configuration. Option D is incorrect because the Microsoft 365 admin center is for service configuration, not client installation.

Answer

Use Microsoft Intune to deploy Office by selecting the built-in Office 365 app type and then modify the installation options.

Answer

Use the Microsoft 365 admin center to assign licenses and then have users install from the portal.

Answer

Use Microsoft Configuration Manager to deploy Office with a task sequence.

Question 3

Users have iOS/iPadOS devices enrolled in Intune. You need to ensure that corporate data in managed apps is encrypted at rest. What should you configure?

Accepted Answer

App protection policy for iOS/iPadOS. Option B is correct because app protection policies can enforce encryption of app data. Option A is wrong because compliance policies do not encrypt app data. Option C is wrong because device configuration profiles manage device settings, not app-level encryption. Option D is wrong because iOS itself encrypts at the device level, but not app-specific data.

Answer

iOS native encryption feature

Answer

Compliance policy for iOS/iPadOS

Answer

Device configuration profile with encryption settings

Question 4

Your organization plans to use Windows Autopilot for device provisioning. You need to ensure devices are automatically registered in Microsoft Entra ID when they are powered on for the first time. Which prerequisite must be met?

Accepted Answer

Users must have Microsoft Entra ID P1 or P2 licenses assigned. Option C is correct because Autopilot requires Microsoft Entra ID P1 or P2 licenses to support automatic device registration. Option A is wrong because licenses are needed. Option B is wrong because Autopilot supports both Entra ID join and hybrid join. Option D is wrong because Intune licenses are required for management but Autopilot also requires Entra ID P1.

Answer

Devices must be pre-registered in Intune via an OEM or partner

Answer

Devices must have a TPM 2.0 chip for self-deploying mode

Answer

An on-premises Active Directory domain must be available

Question 5

Refer to the exhibit. You are configuring a device compliance policy in Microsoft Intune for Windows devices. Based on the JSON configuration, what will happen if a device does not have a password set?

Accepted Answer

The device will be marked non-compliant and after 24 hours access will be blocked, then retired after 72 hours. Option C is correct because the compliance policy has a grace period of 24 hours before blocking, and then 72 hours before retiring. The device is not immediately blocked. Option A is wrong because there is a grace period. Option B is wrong because there are two actions: block then retire. Option D is wrong because the device is not immediately retired; it goes through block first.

Answer

The device will be marked non-compliant but no action is taken until the grace period expires

Answer

The device will be retired immediately because password is not set

Answer

The device will be immediately blocked from accessing corporate resources

Question 6

You are deploying Windows 10 to 100 new devices using Microsoft Deployment Toolkit (MDT). You want to integrate with Microsoft Intune for post-deployment management. Which MDT integration method should you use?

Accepted Answer

Create a provisioning package in MDT that includes the Intune enrollment configuration and apply it during the deployment task sequence.. Option A is correct because MDT can generate a provisioning package that includes Intune enrollment details, which is applied during deployment. Option B is incorrect because MDT does not directly integrate with Intune via a connector. Option C is incorrect because Configuration Manager integration is separate. Option D is incorrect because Autopilot is a different deployment method.

Answer

Use Microsoft Configuration Manager to deploy the devices and then co-manage with Intune.

Answer

Configure Windows Autopilot for the devices and skip MDT.

Answer

Install the Intune connector for MDT and configure it during deployment.

Question 7

You are configuring Microsoft Intune for a new organization. You need to ensure that users can only enroll corporate-owned devices and are blocked from enrolling personal devices. Which TWO settings should you configure?

Accepted Answer

Configure enrollment restrictions to set 'Allow personally owned devices' to 'No'.. Options B and D are correct. Device type restrictions allow you to block personal devices. Enrollment restrictions include device platform and personal/corporate settings. Option A is not a restriction setting. Option C is for compliance, not enrollment. Option E is for conditional access, not enrollment blocking.

Answer

Create a conditional access policy that blocks devices not marked as corporate.

Answer

Create a conditional access policy that requires compliant devices.

Answer

Create a device compliance policy that marks personal devices as non-compliant.

Question 8

A user reports that their Windows 11 device is not receiving a required security baseline policy from Microsoft Intune. The device appears as compliant in the Microsoft Intune admin center. Other devices in the same group receive the policy. You verify that the policy is assigned to the correct group and that the user is a member. What is the most likely cause?

Accepted Answer

The device has not checked in with Intune recently or has a policy conflict. Option D is correct because the problem is isolated to one device, and the user is in the correct group. The most likely cause is that the device is in a pending state such as waiting for check-in or has a conflict with another policy. Option A is wrong because if the user were not in the group, the policy would not apply to any devices, but other devices in the same group receive the policy. Option B is wrong because the device is compliant. Option C is wrong because the policy is assigned to the group and other devices receive it.

Answer

The user is not a member of the Azure AD group that the policy is assigned to

Answer

The policy is not assigned to any group

Answer

The device is marked as non-compliant and has been blocked

Question 9

Your organization plans to use Windows Autopilot to provision new devices. Which TWO methods can you use to obtain the hardware hash for a new device?

Accepted Answer

Request the hardware hash from the device manufacturer (OEM). Options A and D are correct. A: If the device is already running Windows, you can use a PowerShell script to get the hardware hash. D: OEMs can provide the hardware hash during manufacturing. Option B is wrong because the hardware hash is not available in BIOS. Option C is wrong because Windows Configuration Designer does not generate hardware hashes. Option E is wrong because Microsoft Intune can import hardware hashes but not generate them.

Answer

Extract the hardware hash from the device BIOS

Answer

Use Microsoft Intune to generate the hardware hash from the device serial number

Answer

Use Windows Configuration Designer to create a provisioning package that captures the hardware hash

Question 10

You are planning a Windows 11 deployment for 200 devices using Microsoft Configuration Manager (current branch). The devices are currently running Windows 10. You need to perform an in-place upgrade while preserving user data and settings. The devices are located in remote offices with limited bandwidth. Which deployment method should you use?

Accepted Answer

Deploy a Windows 11 feature update using the 'Windows 10/11 feature update' servicing plan in Configuration Manager, enabling Delivery Optimization for peer-to-peer download.. For in-place upgrades with limited bandwidth, using peer caching or Delivery Optimization is recommended. However, Configuration Manager supports 'Express updates' for feature updates? No, express updates are for quality updates. For feature updates, you can use 'Windows 10/11 feature update' via 'Windows servicing' or a task sequence. The best approach is to use a task sequence that downloads the upgrade content from a distribution point, but to minimize bandwidth, you can enable BranchCache or use 'Download content from distribution point and run locally'. Among the options, using a task sequence with 'Pre-stage content' on USB drives or using 'Download content from distribution point and run locally' is possible. But the question asks for 'in-place upgrade while preserving user data' and 'limited bandwidth'. Configuration Manager's 'Windows 10/11 feature update' deployment does not support preserving user data? Actually, the 'Feature update' method is an in-place upgrade that preserves apps and settings. It uses Delivery Optimization to download from peers and the internet, which can help with bandwidth. Option A is correct. Option B is wrong because a provisioning package is for new devices. Option C is wrong because Autopilot is not for in-place upgrade. Option D is wrong because a task sequence can preserve data but requires more bandwidth unless you pre-cache content.

Answer

Create a provisioning package with Windows 11 upgrade settings and apply it via USB drives.

Answer

Use Windows Autopilot to reset the device and reinstall Windows 11, restoring user data from OneDrive.

Answer

Create a task sequence to upgrade Windows, and configure it to download content from the internet to reduce distribution point load.

Question 11

Refer to the exhibit. You are reviewing an Intune compliance policy JSON for Windows 10. A device reports as non-compliant, and the compliance status details indicate that the setting 'Secure Boot' is not compliant. The device is a virtual machine. What is the most likely reason?

Accepted Answer

The virtual machine does not have Secure Boot enabled in its firmware settings.. Secure Boot is a hardware-based feature that ensures the system boots using only software that is trusted by the PC manufacturer. Virtual machines typically do not have Secure Boot enabled by default, or they may not support it. Option B is correct. Option A is wrong because the device might be managed. Option C is wrong because BitLocker is separate. Option D is wrong because the password policy is not related.

Answer

The device is not enrolled in Intune correctly.

Answer

The password policy is conflicting with Secure Boot.

Answer

The device does not have BitLocker enabled, which is required for Secure Boot.

Question 12

You need to configure Windows Update for Business policies using Intune. You want to defer feature updates by 60 days and quality updates by 14 days. Which policy setting should you use?

Accepted Answer

Windows 10 and later update ring. Option A is correct because the Update Rings policy includes settings for deferral periods. Option B is wrong because feature updates policy is for version targeting. Option C is wrong because driver updates policy is separate. Option D is wrong because Windows Update for Business is not a compliance policy.

Answer

Windows compliance policy

Answer

Windows feature update policy

Answer

Windows driver update policy

Question 13

Your company uses Microsoft Intune to manage Windows devices. Users frequently work from public Wi-Fi and the security team is concerned about unmanaged devices accessing corporate resources. You need to ensure that only devices compliant with your security policies can access Microsoft 365 services. What should you implement?

Accepted Answer

Configure Conditional Access policies in Microsoft Entra ID that require compliant devices. Option D is correct because Conditional Access with device compliance policies is the standard approach to restrict access to compliant devices. Option A is wrong because VPN enforcement is not a direct Intune feature for conditional access. Option B is wrong because autopilot doesn't enforce access control. Option C is wrong because compliance policies alone don't enforce access; they require Conditional Access.

Answer

Deploy Windows Autopilot for all devices and require Entra ID join

Answer

Configure a VPN profile in Intune and enforce device compliance on the VPN server

Answer

Create a compliance policy in Intune and assign it to all users

Question 14

Your organization is implementing Windows Autopilot. Which TWO prerequisites must be met before you can use Autopilot?

Accepted Answer

Microsoft Intune licenses. Option B and Option D are correct because Autopilot requires Microsoft Entra ID P1/P2 and Intune licenses. Option A is wrong because on-prem AD is not required. Option C is wrong because Configuration Manager is not required. Option E is wrong because a TPM is only required for self-deploying mode.

Answer

An on-premises Active Directory domain

Answer

Configuration Manager

Answer

TPM 2.0 chip on all devices

Question 15

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that corporate data on Android Enterprise work profiles is protected so that users cannot copy and paste data from work apps to personal apps. Which configuration should you implement?

Accepted Answer

Create an app protection policy that restricts data transfer between work and personal apps.. Option B is correct because app protection policies (MAM) can restrict data transfer between work and personal contexts. Option A is incorrect because compliance policies do not control copy/paste behavior. Option C is incorrect because configuration policies set app settings, not data protection. Option D is incorrect because device compliance policies are not granular enough.

Answer

Create a device configuration policy that disables clipboard sharing.

Answer

Create a device compliance policy that requires a work profile.

Answer

Create a conditional access policy that blocks personal apps.