MD-102 Practice Test 9 — 10 Questions

Question 1

You have the following JSON compliance policy for Windows 10 devices in Intune. A device with OS version 10.0.19042.0, build 19042, with BitLocker enabled, Secure Boot enabled, but Code Integrity disabled reports as non-compliant. Which setting is causing the non-compliance?

Accepted Answer

requireCodeIntegrity. The device reports as non-compliant because the compliance policy requires `requireCodeIntegrity` to be enabled, but the device has Code Integrity disabled. Even though BitLocker and Secure Boot are enabled, and the OS version meets the minimum requirement, the absence of Code Integrity enforcement triggers non-compliance. In Intune, Windows 10 compliance policies evaluate each setting independently, and a failure on any required setting results in overall non-compliance.

Answer

minimumOsVersion

Answer

requireSecureBoot

Answer

requireDeviceEncryption

Question 2

An administrator is configuring Microsoft Entra ID Protection. They want to create a policy that automatically blocks sign-ins when the risk level is high. However, they notice that the policy is not triggering for some users who have high risk. What is the most likely reason?

Accepted Answer

The user risk policy is set to 'Report-only' mode instead of 'On'.. Option C is correct because when a user risk policy is set to 'Report-only' mode, it evaluates risk and generates reports but does not enforce any actions such as blocking sign-ins. For automatic blocking to occur, the policy must be set to 'On' (enabled). The administrator likely configured the policy correctly in terms of risk level but overlooked the enforcement mode, which is a common misconfiguration in Microsoft Entra ID Protection.

Answer

The sign-in risk policy is overriding the user risk policy.

Answer

The users have MFA enabled, so they are exempt from risk policies.

Answer

The policy is configured to apply only to a test group, and the affected users are not members.

Question 3

Arrange the steps to configure Conditional Access for Microsoft 365 in Azure AD.

Question 4

Arrange the steps to troubleshoot a Windows 10 device failing to enroll in Microsoft Intune.

Question 5

Arrange the steps to perform a Windows 10 feature update using Windows Update for Business in Intune.

Question 6

Arrange the steps to troubleshoot a BitLocker recovery key prompt on a Windows 10 device.

Question 7

Match each MDM (Mobile Device Management) enrollment method to its typical scenario.

Question 8

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are stuck in a reboot loop. The administrator needs to identify devices affected by the issue. Which report in the Microsoft Intune admin center should the administrator use?

Accepted Answer

Windows Update report. The Windows Update report in the Microsoft Intune admin center provides detailed information about Windows 10 update deployments, including devices that are stuck in a reboot loop after an update. This report shows update status, errors, and pending reboots, allowing the administrator to identify affected devices and take remediation actions.

Answer

Update compliance report

Answer

Device compliance report

Answer

Device inventory report

Question 9

A company manages 500 Windows 11 devices with Microsoft Intune. They use BitLocker encryption with automatic encryption enabled. Several devices report that encryption did not start. The administrator reviews the devices and finds that they are not compliant with the BitLocker policy. What is the most likely cause?

Accepted Answer

Devices do not have a Trusted Platform Module (TPM) chip. BitLocker automatic encryption requires a compatible TPM chip to securely store encryption keys and validate system integrity. Without a TPM, BitLocker cannot start the encryption process automatically, leading to non-compliance with the policy. The other options do not directly prevent encryption from starting.

Answer

Devices do not have a secure boot enabled

Answer

Devices are not Azure AD joined

Answer

BitLocker startup key is not saved to Azure AD

Question 10

A company plans to deploy Windows 11 to 500 new devices using Microsoft Deployment Toolkit (MDT). The devices have various hardware configurations. The deployment must include language packs and regional settings. Which deployment method should the administrator use to minimize manual intervention?

Accepted Answer

Create a custom task sequence in MDT that includes language packs and regional settings.. Option A is correct because MDT allows the administrator to create a custom task sequence that integrates language packs and regional settings directly into the deployment process. This approach automates the entire deployment with minimal manual intervention, as the task sequence handles all configuration steps without requiring post-deployment adjustments.

Answer

Use Windows Configuration Designer to create a provisioning package with language settings.

Answer

Create a task sequence in Configuration Manager without MDT integration.

Answer

Use Windows Autopilot with a custom profile to deploy language packs.

MD-102 Practice Test 9 — 10 Questions

Exhibit

MD-102 Practice Test 9 — 10 Questions

Exhibit