MD-102 Timed Practice Test 2 — 10 Questions

Question 1

Which TWO options are valid methods to deploy Windows 10 to new hardware in a Configuration Manager environment?

Accepted Answer

Bootable media deployment. Bootable media deployment (Option D) is a valid method in Configuration Manager because it allows you to create bootable USB or CD/DVD media that contains the boot image, task sequence, and required content. When the media is booted on new hardware, it initiates a task sequence that contacts the Configuration Manager site server to download the OS image and apply it, making it ideal for bare-metal deployments without network connectivity.

Answer

Microsoft Deployment Toolkit (MDT) Lite Touch

Answer

Windows Autopilot self-deploying mode

Answer

Azure Migrate

Question 2

Which THREE conditions must be met for a device to automatically enroll in Windows Autopilot?

Accepted Answer

The device must be Azure AD joined or Hybrid Azure AD joined. Option B is correct because Windows Autopilot requires the device to be either Azure AD joined or Hybrid Azure AD joined to establish a managed identity in the cloud. This identity enables the device to automatically receive a configuration profile that triggers the Autopilot deployment profile during the out-of-box experience (OOBE). Without this join state, the device cannot be recognized as an Autopilot-managed device.

Answer

The device must have BitLocker Drive Encryption enabled

Answer

The user must be a Global Administrator in Azure AD

Question 3

You manage a Microsoft 365 tenant with 10,000 users. You are planning a Conditional Access policy to require MFA for all users. However, you need to ensure that users who have not yet registered for MFA are not blocked. What should you do to handle unregistered users?

Accepted Answer

Enable the Azure AD Identity Protection MFA registration policy to require users to register for MFA within 14 days.. Option B is correct because the Azure AD Identity Protection MFA registration policy automatically enforces MFA registration for all users within a specified grace period (default 14 days), ensuring that users who have not yet registered are prompted to register before being blocked by a Conditional Access policy. This policy works in conjunction with Conditional Access by pre-registering users, so when the CA policy requiring MFA is enabled, all users already have MFA credentials available, preventing lockout.

Answer

Configure the Conditional Access policy in 'Report-only' mode to identify unregistered users.

Answer

Exclude all users who have not registered for MFA from the Conditional Access policy.

Answer

Create a separate Conditional Access policy that requires MFA only for users who have not registered for MFA.

Question 4

A company with 500 users uses Microsoft 365 E3 licenses. They want to ensure that all users have multi-factor authentication (MFA) enforced. Currently, 80% of users have MFA enabled through the legacy per-user MFA setting. The security team wants to use Conditional Access policies instead. You need to migrate from per-user MFA to Conditional Access with no disruption to users. What should you do?

Accepted Answer

Create a Conditional Access policy requiring MFA for all users, excluding break-glass accounts. Disable per-user MFA for all users.. Option C is correct because you need to exclude the break-glass accounts from the Conditional Access policy to ensure admin access if something goes wrong. You should first create a Conditional Access policy that requires MFA for all users except the break-glass accounts, then disable the per-user MFA for all users. Option A is incorrect because disabling per-user MFA before creating the policy would leave users without MFA. Option B is incorrect because using a Conditional Access policy to require MFA from outside the network only would not enforce MFA for internal access. Option D is incorrect because creating a policy without excluding break-glass accounts could lock out administrators.

Answer

Create a Conditional Access policy requiring MFA for all cloud apps, including break-glass accounts. Then disable per-user MFA.

Answer

Create a Conditional Access policy requiring MFA for all users only when accessing from outside the corporate network.

Answer

Disable per-user MFA for all users, then create a Conditional Access policy requiring MFA for all cloud apps.

Question 5

Which THREE of the following are valid methods for deploying Microsoft Intune compliance policies to devices?

Accepted Answer

Assign the policy to a user group, which applies to devices enrolled by those users.. Option A is correct because Microsoft Intune compliance policies can be assigned to user groups, and when a user in the group enrolls a device, the policy applies to that device. This is the most common deployment method, leveraging user-based targeting to ensure compliance settings are enforced on devices associated with those users.

Answer

Assign the policy directly to individual devices from the Intune console.

Answer

Assign the policy to a device category.

Question 6

A multinational organization uses Microsoft 365 E5 licenses. The compliance officer wants to ensure that all documents containing credit card numbers are automatically classified and protected with a label that applies encryption. You configure auto-labeling policies in Microsoft Purview. After 24 hours, the compliance officer reports that no documents have been labeled. The policy scope is set to 'All locations' and the policy is enabled. What is the most likely cause of the issue?

Accepted Answer

The policy is deployed in simulation mode only.. Auto-labeling policies in Microsoft Purview can be configured in simulation mode, which evaluates documents against the policy rules and reports what would be labeled without actually applying any labels. Since the compliance officer reports that no documents have been labeled after 24 hours, the most likely cause is that the policy is still in simulation mode, which is a common deployment step to validate the policy before turning it on for real labeling.

Answer

No sensitivity labels have been published to the users.

Answer

Auto-labeling requires Azure Information Protection (AIP) add-on license.

Answer

The priority of the policy is too low compared to other policies.

Question 7

A company uses Microsoft Intune to manage devices. They want to ensure that when a device is reported as lost or stolen, the IT admin can remotely wipe the device. Which action should the admin take in the Intune console?

Accepted Answer

Select the device and choose 'Wipe'.. The 'Wipe' action in Microsoft Intune restores a device to its factory default settings, removing all corporate and personal data. This is the appropriate action for a lost or stolen device to prevent unauthorized access to company data. The 'Retire' action only removes managed app data and policies but leaves personal data intact, which is insufficient for a security breach scenario.

Answer

Select the device and choose 'Retire'.

Answer

Select the device and choose 'Reset'.

Answer

Select the device and choose 'Delete'.

Question 8

An organization uses Microsoft Intune to manage Windows 10 devices. They deploy a PowerShell script via Intune to install a custom application. The script runs successfully on some devices but fails on others with error code 0x80070002. What is the most likely cause?

Accepted Answer

The script references a file path that does not exist on the failing devices.. Option B is correct because the script likely references a file that is not present. Option A is wrong because execution policy can be bypassed by Intune. Option C is wrong because admin rights are granted. Option D is wrong because script timeout would give a different error.

Answer

The script execution exceeds the 60-minute timeout.

Answer

The user does not have local administrator privileges on the failing devices.

Answer

The PowerShell execution policy is set to Restricted on the failing devices.

Question 9

An organization uses Configuration Manager to manage Windows 10 devices. The administrator is configuring a phased deployment for a software update. Which THREE conditions can be used to define the phases?

Accepted Answer

Collection membership. Collection membership (A) is correct because Configuration Manager phased deployments allow you to specify a target collection for each phase, such as a collection containing pilot devices for the first phase and a broader collection for subsequent phases. This enables granular control over which devices receive the update at each stage, based on existing collection membership rules.

Answer

Time-based delay between phases

Answer

Device compliance status

Question 10

A company uses Microsoft Intune to manage devices. They have a Windows 10 device that is non-compliant due to missing required updates. The administrator reviews the device and sees the update status shows 'Pending restart'. Which THREE actions should the administrator take to resolve the compliance issue?

Accepted Answer

Check the Update Rings policy for deferral settings.. Option A is correct because Update Rings policy deferral settings can delay the installation of required updates, causing the device to show a 'Pending restart' status without actually applying the updates. By checking and adjusting these deferral settings, the administrator can ensure updates are installed promptly, resolving the non-compliance issue.

Answer

Wait for the automatic restart from the compliance policy.

Answer

Re-enroll the device in Intune.