MD-102 Hard Questions — 25 Difficult Questions

Question 1

You are deploying a custom Windows 10 image to 200 new laptops using MDT. The deployment fails on several devices at the 'Apply Operating System' step with error 0x80070070. The laptops have 60 GB SSDs and 4 GB RAM. What is the most likely cause?

Accepted Answer

The custom image is too large for the 60 GB SSD.. Error 0x80070070 translates to 'insufficient disk space' (ERROR_DISK_FULL). During the 'Apply Operating System' step, MDT decompresses the custom WIM image and applies it to the local disk. With a 60 GB SSD, if the custom image (including drivers, updates, and applications) exceeds the available free space after partitioning, the deployment fails. This is the most direct cause given the error code and hardware constraints.

Answer

The laptops have insufficient RAM (4 GB) to run the deployment.

Answer

The deployment share is not accessible over the network.

Answer

The custom image is missing critical drivers.

Question 2

You are a Teams administrator. After running the PowerShell script shown in the exhibit, users report they cannot communicate with federated users from 'trusted.com'. What is the most likely cause?

Accepted Answer

The script did not run in a Teams PowerShell session that supports the Set-CsTenantFederationConfiguration cmdlet.. Option D is correct because the `Set-CsTenantFederationConfiguration` cmdlet is only available in a remote Teams PowerShell session (connected via `Connect-MicrosoftTeams`), not in a local Skype for Business Online or legacy PowerShell module. If the script was run in an incompatible session (e.g., an older Skype for Business Online Connector or a local PowerShell window without proper module import), the cmdlet would not execute, leaving the federation configuration unchanged. This would cause the default settings to block federated communication with 'trusted.com'.

Answer

The AllowedDomains list does not include a wildcard ' * ' to allow all domains, so only trusted.com is allowed.

Answer

The script sets AllowPublicUsers to $false, which blocks all external communication including federated users.

Answer

The script sets AllowFederatedUsers to $true, which disables federated user communication.

Question 3

A company uses Configuration Manager to deploy Windows 10 to 2000 devices. After deployment, several devices report that the Start menu layout is not applied. The administrator used a provisioning package to configure Start layout. What is the most likely cause of the issue?

Accepted Answer

Group Policy settings are overriding the Start layout configuration.. Option C is correct because provisioning packages apply during OOBE and may be overwritten by Group Policy. Option A is wrong because user profile issue would not affect all. Option B is wrong because MDM is not used. Option D is wrong because the package is applied, just overridden.

Answer

The devices are not Azure AD joined.

Answer

The provisioning package was not signed properly.

Answer

The provisioning package was applied after user first logon.

Question 4

Which THREE conditions must be met for a device to automatically enroll in Windows Autopilot?

Accepted Answer

The device must be Azure AD joined or Hybrid Azure AD joined. Option B is correct because Windows Autopilot requires the device to be either Azure AD joined or Hybrid Azure AD joined to establish a managed identity in the cloud. This identity enables the device to automatically receive a configuration profile that triggers the Autopilot deployment profile during the out-of-box experience (OOBE). Without this join state, the device cannot be recognized as an Autopilot-managed device.

Answer

The device must have BitLocker Drive Encryption enabled

Answer

The user must be a Global Administrator in Azure AD

Question 5

You manage a Microsoft 365 tenant with 10,000 users. You are planning a Conditional Access policy to require MFA for all users. However, you need to ensure that users who have not yet registered for MFA are not blocked. What should you do to handle unregistered users?

Accepted Answer

Enable the Azure AD Identity Protection MFA registration policy to require users to register for MFA within 14 days.. Option B is correct because the Azure AD Identity Protection MFA registration policy automatically enforces MFA registration for all users within a specified grace period (default 14 days), ensuring that users who have not yet registered are prompted to register before being blocked by a Conditional Access policy. This policy works in conjunction with Conditional Access by pre-registering users, so when the CA policy requiring MFA is enabled, all users already have MFA credentials available, preventing lockout.

Answer

Configure the Conditional Access policy in 'Report-only' mode to identify unregistered users.

Answer

Exclude all users who have not registered for MFA from the Conditional Access policy.

Answer

Create a separate Conditional Access policy that requires MFA only for users who have not registered for MFA.

Question 6

A multinational organization uses Microsoft 365 E5 licenses. The compliance officer wants to ensure that all documents containing credit card numbers are automatically classified and protected with a label that applies encryption. You configure auto-labeling policies in Microsoft Purview. After 24 hours, the compliance officer reports that no documents have been labeled. The policy scope is set to 'All locations' and the policy is enabled. What is the most likely cause of the issue?

Accepted Answer

The policy is deployed in simulation mode only.. Auto-labeling policies in Microsoft Purview can be configured in simulation mode, which evaluates documents against the policy rules and reports what would be labeled without actually applying any labels. Since the compliance officer reports that no documents have been labeled after 24 hours, the most likely cause is that the policy is still in simulation mode, which is a common deployment step to validate the policy before turning it on for real labeling.

Answer

No sensitivity labels have been published to the users.

Answer

Auto-labeling requires Azure Information Protection (AIP) add-on license.

Answer

The priority of the policy is too low compared to other policies.

Question 7

An organization uses Microsoft Intune to manage Windows 10 devices. They deploy a PowerShell script via Intune to install a custom application. The script runs successfully on some devices but fails on others with error code 0x80070002. What is the most likely cause?

Accepted Answer

The script references a file path that does not exist on the failing devices.. Option B is correct because the script likely references a file that is not present. Option A is wrong because execution policy can be bypassed by Intune. Option C is wrong because admin rights are granted. Option D is wrong because script timeout would give a different error.

Answer

The script execution exceeds the 60-minute timeout.

Answer

The user does not have local administrator privileges on the failing devices.

Answer

The PowerShell execution policy is set to Restricted on the failing devices.

Question 8

An organization uses Configuration Manager to manage Windows 10 devices. The administrator is configuring a phased deployment for a software update. Which THREE conditions can be used to define the phases?

Accepted Answer

Collection membership. Collection membership (A) is correct because Configuration Manager phased deployments allow you to specify a target collection for each phase, such as a collection containing pilot devices for the first phase and a broader collection for subsequent phases. This enables granular control over which devices receive the update at each stage, based on existing collection membership rules.

Answer

Time-based delay between phases

Answer

Device compliance status

Question 9

A company uses Microsoft Intune to manage devices. They have a Windows 10 device that is non-compliant due to missing required updates. The administrator reviews the device and sees the update status shows 'Pending restart'. Which THREE actions should the administrator take to resolve the compliance issue?

Accepted Answer

Check the Update Rings policy for deferral settings.. Option A is correct because Update Rings policy deferral settings can delay the installation of required updates, causing the device to show a 'Pending restart' status without actually applying the updates. By checking and adjusting these deferral settings, the administrator can ensure updates are installed promptly, resolving the non-compliance issue.

Answer

Wait for the automatic restart from the compliance policy.

Answer

Re-enroll the device in Intune.

Question 10

You are troubleshooting a Windows 10 device that is enrolled in Microsoft Intune. The device shows as 'Pending' in the Intune console. The user confirms that the device was enrolled using a provisioning package. Which log file should you review to diagnose the enrollment failure?

Accepted Answer

%ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. When a Windows 10 device is enrolled using a provisioning package, the provisioning engine logs detailed information about the package processing and enrollment steps in %ProgramData%\Microsoft\Provisioning\ProvisioningPackage.log. This log captures the execution of the provisioning package, including any errors during enrollment, making it the correct source for diagnosing a 'Pending' status caused by a provisioning package failure.

Answer

%windir%	emp\MdmEnrollment.log

Answer

%windir%\Panther\setupact.log

Answer

Event Viewer under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider

Question 11

A company uses Microsoft Intune to manage Windows 10 devices. A user reports that their device is not receiving critical security updates despite being compliant with all update policies. You verify that the device is online and communicating with Intune. Which action should you take to resolve the issue?

Accepted Answer

Review the Windows Update Rings policy assigned to the device and adjust the deferral settings for quality updates.. The user's device is compliant and online, but not receiving critical security updates. The most likely cause is that the Windows Update Rings policy assigned to the device has a deferral period configured for quality updates, which delays the installation of security patches. Adjusting the deferral settings for quality updates to 0 days ensures that critical security updates are installed immediately upon release, resolving the issue without changing the feature update deferral.

Answer

Verify that the device meets the minimum hardware requirements for the update.

Answer

Force a sync from the device via Intune Company Portal or Settings > Accounts > Access work or school.

Answer

Reassign the device to a different Update Ring policy that has no feature update deferral.

Question 12

An organization uses Configuration Manager to deploy Windows 11. The administrator needs to ensure that after deployment, the devices are automatically enrolled in Microsoft Intune for co-management. Which THREE actions are required?

Accepted Answer

Configure Azure AD hybrid join in the environment.. Azure AD hybrid join is required for co-management because it allows devices to be registered in both on-premises Active Directory and Azure AD, enabling them to be managed by both Configuration Manager and Intune simultaneously. Without hybrid join, devices cannot authenticate to Intune for enrollment, as co-management relies on Azure AD identity for device registration and policy assignment.

Answer

Enable WinRM on the target devices.

Answer

Configure a Group Policy for automatic Intune enrollment.

Question 13

During a Windows 10 in-place upgrade using Configuration Manager, the task sequence fails with error code 0x800706BE. The smsts.log shows 'Failed to run the action: Upgrade Operating System'. What is the most likely cause?

Accepted Answer

Antivirus software blocking the upgrade process. Error code 0x800706BE is a generic 'The remote procedure call failed' error, which in the context of a Configuration Manager task sequence during an in-place upgrade is most commonly caused by antivirus software interfering with the setup process. Antivirus real-time scanning can lock files or block critical RPC calls that the Windows Setup engine requires, leading to the 'Failed to run the action: Upgrade Operating System' failure in smsts.log.

Answer

Incompatible third-party drivers

Answer

Corrupted setup files in the OS upgrade package

Answer

Insufficient disk space on the system drive

Question 14

A company uses Configuration Manager to deploy Windows 11. During the deployment, several devices fail with error code 0x80070002. The administrator suspects the issue is related to missing boot images or content distribution. What should the administrator do first to resolve the issue?

Accepted Answer

Verify that the boot image and OS image are distributed to all distribution points.. Error code 0x80070002 translates to 'The system cannot find the file specified.' In a Configuration Manager task sequence deployment, this typically indicates that the boot image or OS image content is not available on the distribution point that the client is accessing. Verifying distribution ensures the required content is present and accessible, which is the most direct and common fix for this error.

Answer

Increase the client cache size on the affected devices.

Answer

Check the driver packages in the task sequence.

Answer

Recreate the task sequence with new OS image.

Question 15

You are designing a Windows Autopilot deployment for a global organization. Devices are purchased from multiple OEMs and shipped directly to users. Some users report that their devices do not register in Autopilot automatically. You confirm the devices have Windows 11 Pro preinstalled and meet hardware requirements. What is the most likely reason for the registration failure, and what should you do to resolve it?

Accepted Answer

The devices are not registered in Autopilot by the OEM; collect the hardware hash using a script. The most likely reason is that the OEM did not register the devices in Windows Autopilot by uploading their hardware hashes to the Microsoft Partner Center. Without this registration, the devices will not be recognized during OOBE and will not automatically receive the Autopilot deployment profile. To resolve this, you must collect the hardware hash from each device using a PowerShell script (e.g., Get-WindowsAutopilotInfo.ps1) and manually upload it to Intune or the Partner Center.

Answer

The devices have a TPM chip that is not compliant with Autopilot requirements

Answer

The Autopilot deployment profile is assigned to a dynamic device group that excludes these devices

Answer

The devices are not connected to the internet during OOBE

Question 16

An organization is deploying Windows 10 using Configuration Manager task sequences. During a pilot deployment, the task sequence fails with error code 0x80070002. What is the most likely cause?

Accepted Answer

The boot image is missing or corrupted. Error code 0x80070002 translates to 'The system cannot find the file specified.' In the context of a Configuration Manager task sequence, this typically indicates that the boot image (WIM file) referenced by the task sequence is missing from the distribution point or is corrupted. The boot image is required to start Windows PE and initiate the OS deployment; if it cannot be located or loaded, the task sequence fails immediately.

Answer

The device does not meet minimum hardware requirements

Answer

The task sequence includes a duplicate step

Answer

The distribution point is unreachable

Question 17

You are configuring Windows Autopilot for a customer who has a hybrid Azure AD join deployment. The devices are self-deploying using a self-deploying profile. Which THREE prerequisites must be met for the self-deploying mode to work?

Accepted Answer

The device must be registered in Windows Autopilot. Option A is correct because a device must be registered in Windows Autopilot to associate it with a self-deploying profile. Registration is done by uploading the device's hardware hash to the Autopilot service, which then links the device to the profile and enables automatic provisioning without user interaction.

Answer

The local administrator account must be enabled

Answer

The user must be assigned a Windows Autopilot license

Question 18

You are an endpoint administrator for a company that uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access Exchange Online. You have configured a Conditional Access policy that grants access to Exchange Online only if the device is marked as compliant. A user reports that they cannot access email from their iOS device, which is enrolled in Intune and shows as compliant. The user can access other Microsoft 365 services. What is the most likely cause?

Accepted Answer

The Exchange Online workload is not enabled in Intune for mobile device management.. The most likely cause is that the Exchange Online workload is not enabled in Intune for mobile device management (MDM). Even though the device is enrolled and compliant, Intune must have the Exchange Online workload enabled to apply Conditional Access policies that govern email access. Without this, the Conditional Access policy cannot enforce compliance checks specifically for Exchange Online, resulting in access being blocked despite the device showing as compliant.

Answer

The user does not have an Exchange Online license assigned.

Answer

The Conditional Access policy is configured to block access from non-corporate networks.

Answer

The device compliance policy is not set to require a PIN or password.

Question 19

Refer to the exhibit. The JSON snippet shows the Azure AD Identity Protection MFA registration policy configuration for the Contoso tenant. A new user, Jane, joins the company and is assigned a license. Jane attempts to access the Azure portal and is prompted to register for MFA. She registers successfully. However, the next day, she is again prompted to register for MFA. What is the most likely cause?

Accepted Answer

The user's MFA registration is being reset due to a synchronization issue with on-premises Active Directory.. The most likely cause is that the user's MFA registration is being reset due to a synchronization issue with on-premises Active Directory. When Azure AD Connect synchronizes a user object from on-premises AD, it can overwrite the cloud MFA registration state if the on-premises attribute (such as 'StrongAuthenticationMethods' or 'StrongAuthenticationTime') is not set or is reset. This causes the user to be treated as unregistered, prompting MFA registration again despite a previous successful registration.

Answer

The MFA registration policy is disabled.

Answer

The policy is not including all users.

Answer

The policy excludes the user Jane.

Question 20

An organization has deployed Microsoft Entra Connect Sync to synchronize on-premises Active Directory to Microsoft Entra ID. Users report that some cloud-only user accounts cannot be assigned licenses. The admin checks the provisioning logs and finds that the cloud accounts have a source of authority of 'Microsoft Entra ID'. What is the most likely cause?

Accepted Answer

The accounts are missing the 'UsageLocation' attribute, which is required for license assignment.. The most likely cause is that the cloud-only user accounts are missing the 'UsageLocation' attribute. In Microsoft Entra ID, a UsageLocation must be set before licenses can be assigned to any user, including cloud-only accounts. Without this attribute, license assignment fails regardless of the user's source of authority.

Answer

The accounts have the 'cloudOnly' attribute set to true, which blocks license assignment.

Answer

The accounts have no proxyAddresses, so licensing fails.

Answer

The users are not synchronized because the sync schedule is set to manual.