MD-102 Exam Simulation — 100 Questions

Question 1

You are deploying a custom Windows 10 image to 200 new laptops using MDT. The deployment fails on several devices at the 'Apply Operating System' step with error 0x80070070. The laptops have 60 GB SSDs and 4 GB RAM. What is the most likely cause?

Accepted Answer

The custom image is too large for the 60 GB SSD.. Error 0x80070070 translates to 'insufficient disk space' (ERROR_DISK_FULL). During the 'Apply Operating System' step, MDT decompresses the custom WIM image and applies it to the local disk. With a 60 GB SSD, if the custom image (including drivers, updates, and applications) exceeds the available free space after partitioning, the deployment fails. This is the most direct cause given the error code and hardware constraints.

Answer

The laptops have insufficient RAM (4 GB) to run the deployment.

Answer

The deployment share is not accessible over the network.

Answer

The custom image is missing critical drivers.

Question 2

A company uses Windows Autopilot for user-driven deployments. They want to ensure that during the out-of-box experience (OOBE), users are required to sign in with their Azure AD credentials and the device is automatically enrolled in Intune. Which Autopilot deployment profile setting should be configured?

Accepted Answer

Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Azure AD joined'.. Option D is correct because the scenario requires a user-driven deployment where the user signs in with Azure AD credentials during OOBE, and the device is automatically enrolled in Intune. Setting 'Deployment mode' to 'User-Driven' ensures the user authenticates during OOBE, and 'Join to Azure AD as' to 'Azure AD joined' makes the device Azure AD-joined, which triggers automatic Intune enrollment via the MDM enrollment authority configured in Azure AD.

Answer

Set 'Deployment mode' to 'Self-Deploying' and 'Join to Azure AD as' to 'Azure AD joined'.

Answer

Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Hybrid Azure AD joined'.

Answer

Set 'Deployment mode' to 'White Glove' and 'Join to Azure AD as' to 'Azure AD joined'.

Question 3

You are a Teams administrator. After running the PowerShell script shown in the exhibit, users report they cannot communicate with federated users from 'trusted.com'. What is the most likely cause?

Accepted Answer

The script did not run in a Teams PowerShell session that supports the Set-CsTenantFederationConfiguration cmdlet.. Option D is correct because the `Set-CsTenantFederationConfiguration` cmdlet is only available in a remote Teams PowerShell session (connected via `Connect-MicrosoftTeams`), not in a local Skype for Business Online or legacy PowerShell module. If the script was run in an incompatible session (e.g., an older Skype for Business Online Connector or a local PowerShell window without proper module import), the cmdlet would not execute, leaving the federation configuration unchanged. This would cause the default settings to block federated communication with 'trusted.com'.

Answer

The AllowedDomains list does not include a wildcard ' * ' to allow all domains, so only trusted.com is allowed.

Answer

The script sets AllowPublicUsers to $false, which blocks all external communication including federated users.

Answer

The script sets AllowFederatedUsers to $true, which disables federated user communication.

Question 4

Match each Co-management workload to its management authority when co-managed.

Question 5

Match each Microsoft 365 compliance feature to its description.

Question 6

Which TWO actions are supported by Microsoft Intune for managing macOS devices?

Accepted Answer

Apply device compliance policies.. Option B is correct because Microsoft Intune supports device compliance policies for macOS devices, allowing administrators to define rules (e.g., OS version, encryption status, firewall settings) that devices must meet to be considered compliant. These policies are evaluated by the Intune Company Portal app on macOS and can trigger conditional access controls to block non-compliant devices from accessing corporate resources.

Answer

Configure Windows Hello for Business.

Answer

Enable BitLocker encryption.

Answer

Deploy .app applications.

Question 7

A company uses Configuration Manager to deploy Windows 10 to 2000 devices. After deployment, several devices report that the Start menu layout is not applied. The administrator used a provisioning package to configure Start layout. What is the most likely cause of the issue?

Accepted Answer

Group Policy settings are overriding the Start layout configuration.. Option C is correct because provisioning packages apply during OOBE and may be overwritten by Group Policy. Option A is wrong because user profile issue would not affect all. Option B is wrong because MDM is not used. Option D is wrong because the package is applied, just overridden.

Answer

The devices are not Azure AD joined.

Answer

The provisioning package was not signed properly.

Answer

The provisioning package was applied after user first logon.

Question 8

You need to deploy Windows 11 to a remote office with limited bandwidth. Which deployment method is most appropriate?

Accepted Answer

Deployment using BranchCache. BranchCache is the most appropriate deployment method for a remote office with limited bandwidth because it allows clients to cache content locally from a peer after the first download, reducing WAN link usage. In Windows deployment, BranchCache can be used with Configuration Manager or standalone to distribute OS images efficiently by having clients retrieve data from local peers rather than repeatedly downloading from a central source over a slow link.

Answer

Cloud-based deployment using Windows Autopilot

Answer

PXE boot deployment from a local server

Answer

Multicast deployment from a central location

Question 9

A company uses Configuration Manager to deploy Windows 11. During the deployment, the task sequence fails at the 'Apply Operating System' step. The error log shows 'Failed to find a valid operating system image package'. You verify that the operating system image package exists and is distributed to the distribution point. What is the most likely cause?

Accepted Answer

The operating system image package is not enabled for use with task sequences. Option C is correct because when an operating system image package exists and is distributed to distribution points but the task sequence fails with 'Failed to find a valid operating system image package', the most common cause is that the image package is not enabled for use with task sequences. In Configuration Manager, each OS image package has a property 'Enable this operating system image for use in task sequences' that must be checked; if unchecked, the task sequence engine cannot reference the package during the Apply Operating System step, even though the package is present and distributed.

Answer

The client computer does not have enough disk space

Answer

The task sequence is not associated with the correct boot image

Answer

The distribution point is not configured to support PXE boot

Question 10

A company plans to deploy Windows 11 to 500 devices using Microsoft Deployment Toolkit (MDT). The deployment must be fully automated with minimal user interaction. Which configuration should be used in the CustomSettings.ini file?

Accepted Answer

SkipWizard=YES. Option C is correct because `SkipWizard=YES` in the CustomSettings.ini file tells MDT to bypass all deployment wizard pages, enabling a fully unattended, zero-touch deployment. This is the specific setting required to achieve minimal user interaction during the MDT deployment process.

Answer

SkipApps=YES

Answer

UserDataLocation=AUTO

Answer

DoNotCreateExtraPartition=YES

Question 11

Which TWO options are valid methods to deploy Windows 10 to new hardware in a Configuration Manager environment?

Accepted Answer

Bootable media deployment. Bootable media deployment (Option D) is a valid method in Configuration Manager because it allows you to create bootable USB or CD/DVD media that contains the boot image, task sequence, and required content. When the media is booted on new hardware, it initiates a task sequence that contacts the Configuration Manager site server to download the OS image and apply it, making it ideal for bare-metal deployments without network connectivity.

Answer

Microsoft Deployment Toolkit (MDT) Lite Touch

Answer

Windows Autopilot self-deploying mode

Answer

Azure Migrate

Question 12

Which THREE conditions must be met for a device to automatically enroll in Windows Autopilot?

Accepted Answer

The device must be Azure AD joined or Hybrid Azure AD joined. Option B is correct because Windows Autopilot requires the device to be either Azure AD joined or Hybrid Azure AD joined to establish a managed identity in the cloud. This identity enables the device to automatically receive a configuration profile that triggers the Autopilot deployment profile during the out-of-box experience (OOBE). Without this join state, the device cannot be recognized as an Autopilot-managed device.

Answer

The device must have BitLocker Drive Encryption enabled

Answer

The user must be a Global Administrator in Azure AD

Question 13

You manage a Microsoft 365 tenant with 10,000 users. You are planning a Conditional Access policy to require MFA for all users. However, you need to ensure that users who have not yet registered for MFA are not blocked. What should you do to handle unregistered users?

Accepted Answer

Enable the Azure AD Identity Protection MFA registration policy to require users to register for MFA within 14 days.. Option B is correct because the Azure AD Identity Protection MFA registration policy automatically enforces MFA registration for all users within a specified grace period (default 14 days), ensuring that users who have not yet registered are prompted to register before being blocked by a Conditional Access policy. This policy works in conjunction with Conditional Access by pre-registering users, so when the CA policy requiring MFA is enabled, all users already have MFA credentials available, preventing lockout.

Answer

Configure the Conditional Access policy in 'Report-only' mode to identify unregistered users.

Answer

Exclude all users who have not registered for MFA from the Conditional Access policy.

Answer

Create a separate Conditional Access policy that requires MFA only for users who have not registered for MFA.

Question 14

A company with 500 users uses Microsoft 365 E3 licenses. They want to ensure that all users have multi-factor authentication (MFA) enforced. Currently, 80% of users have MFA enabled through the legacy per-user MFA setting. The security team wants to use Conditional Access policies instead. You need to migrate from per-user MFA to Conditional Access with no disruption to users. What should you do?

Accepted Answer

Create a Conditional Access policy requiring MFA for all users, excluding break-glass accounts. Disable per-user MFA for all users.. Option C is correct because you need to exclude the break-glass accounts from the Conditional Access policy to ensure admin access if something goes wrong. You should first create a Conditional Access policy that requires MFA for all users except the break-glass accounts, then disable the per-user MFA for all users. Option A is incorrect because disabling per-user MFA before creating the policy would leave users without MFA. Option B is incorrect because using a Conditional Access policy to require MFA from outside the network only would not enforce MFA for internal access. Option D is incorrect because creating a policy without excluding break-glass accounts could lock out administrators.

Answer

Create a Conditional Access policy requiring MFA for all cloud apps, including break-glass accounts. Then disable per-user MFA.

Answer

Create a Conditional Access policy requiring MFA for all users only when accessing from outside the corporate network.

Answer

Disable per-user MFA for all users, then create a Conditional Access policy requiring MFA for all cloud apps.

Question 15

Which THREE of the following are valid methods for deploying Microsoft Intune compliance policies to devices?

Accepted Answer

Assign the policy to a user group, which applies to devices enrolled by those users.. Option A is correct because Microsoft Intune compliance policies can be assigned to user groups, and when a user in the group enrolls a device, the policy applies to that device. This is the most common deployment method, leveraging user-based targeting to ensure compliance settings are enforced on devices associated with those users.

Answer

Assign the policy directly to individual devices from the Intune console.

Answer

Assign the policy to a device category.

Question 16

A multinational organization uses Microsoft 365 E5 licenses. The compliance officer wants to ensure that all documents containing credit card numbers are automatically classified and protected with a label that applies encryption. You configure auto-labeling policies in Microsoft Purview. After 24 hours, the compliance officer reports that no documents have been labeled. The policy scope is set to 'All locations' and the policy is enabled. What is the most likely cause of the issue?

Accepted Answer

The policy is deployed in simulation mode only.. Auto-labeling policies in Microsoft Purview can be configured in simulation mode, which evaluates documents against the policy rules and reports what would be labeled without actually applying any labels. Since the compliance officer reports that no documents have been labeled after 24 hours, the most likely cause is that the policy is still in simulation mode, which is a common deployment step to validate the policy before turning it on for real labeling.

Answer

No sensitivity labels have been published to the users.

Answer

Auto-labeling requires Azure Information Protection (AIP) add-on license.

Answer

The priority of the policy is too low compared to other policies.

Question 17

A company uses Microsoft Intune to manage devices. They want to ensure that when a device is reported as lost or stolen, the IT admin can remotely wipe the device. Which action should the admin take in the Intune console?

Accepted Answer

Select the device and choose 'Wipe'.. The 'Wipe' action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost or stolen device to prevent unauthorized access to company data. The 'Retire' action only removes managed app data and policies but leaves personal data intact, which is insufficient for a security breach scenario.

Answer

Select the device and choose 'Retire'.

Answer

Select the device and choose 'Reset'.

Answer

Select the device and choose 'Delete'.

Question 18

An organization uses Microsoft Intune to manage Windows 10 devices. They deploy a PowerShell script via Intune to install a custom application. The script runs successfully on some devices but fails on others with error code 0x80070002. What is the most likely cause?

Accepted Answer

The script references a file path that does not exist on the failing devices.. Option B is correct because the script likely references a file that is not present. Option A is wrong because execution policy can be bypassed by Intune. Option C is wrong because admin rights are granted. Option D is wrong because script timeout would give a different error.

Answer

The script execution exceeds the 60-minute timeout.

Answer

The user does not have local administrator privileges on the failing devices.

Answer

The PowerShell execution policy is set to Restricted on the failing devices.

Question 19

An organization uses Configuration Manager to manage Windows 10 devices. The administrator is configuring a phased deployment for a software update. Which THREE conditions can be used to define the phases?

Accepted Answer

Collection membership. Collection membership (A) is correct because Configuration Manager phased deployments allow you to specify a target collection for each phase, such as a collection containing pilot devices for the first phase and a broader collection for subsequent phases. This enables granular control over which devices receive the update at each stage, based on existing collection membership rules.

Answer

Time-based delay between phases

Answer

Device compliance status

Question 20

A company uses Microsoft Intune to manage devices. They have a Windows 10 device that is non-compliant due to missing required updates. The administrator reviews the device and sees the update status shows 'Pending restart'. Which THREE actions should the administrator take to resolve the compliance issue?

Accepted Answer

Check the Update Rings policy for deferral settings.. Option A is correct because Update Rings policy deferral settings can delay the installation of required updates, causing the device to show a 'Pending restart' status without actually applying the updates. By checking and adjusting these deferral settings, the administrator can ensure updates are installed promptly, resolving the non-compliance issue.

Answer

Wait for the automatic restart from the compliance policy.

Answer

Re-enroll the device in Intune.