MD-102 Manage and maintain devices Practice Question
An organization uses Microsoft Intune to manage Windows devices. They need to configure a policy to enforce disk encryption on devices. Which TWO of the following are valid encryption options?
⚠ Common exam trap
Watch out — candidates often confuse file-level encryption (EFS) with full-disk encryption, or mistakenly apply macOS-specific technologies (FileVault, APFS encryption) to Windows devices, forgetting that Intune policies are platform-specific.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BitLocker
BitLocker (A) is correct because it is Microsoft's full-volume disk encryption feature for Windows and is the primary encryption method configured through Intune disk encryption policies. Device encryption (C) is also correct because it is a Windows feature (available on supported devices, often with Modern Standby and a Microsoft account) that Intune can enforce via the same disk encryption policy profile. EFS (B) is not a valid answer here because it encrypts individual files and folders on NTFS volumes rather than enforcing full disk encryption. FileVault (D) is incorrect because it is Apple's macOS disk encryption technology, not a Windows encryption option. APFS encryption (E) is incorrect because APFS is an Apple file system and its encryption applies to macOS/iOS devices, not Windows devices managed by Intune.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
BitLocker
Why this is correct
BitLocker is the native Windows volume-level encryption technology, configurable through Intune's disk encryption policy for Windows devices. It satisfies the stem's requirement for a valid encryption option to enforce disk encryption across managed Windows endpoints.
- ✗
Encrypting File System (EFS)
Why it's wrong here
EFS encrypts individual files and folders on NTFS volumes, tied to a user certificate, and is not a full-disk encryption option offered by Intune's Windows encryption policy. The policy exposes BitLocker for Windows and Personal Data Encryption. EFS would suit protecting selected files, not enforcing whole-disk encryption.
- ✓
Device encryption
Why this is correct
Device encryption is a distinct Intune disk encryption setting that enables Windows device encryption on supported hardware, separate from full BitLocker management. It satisfies the stem's requirement for a valid encryption option to enforce disk encryption on Windows devices.
- ✗
FileVault
Why it's wrong here
FileVault is Apple's macOS full-disk encryption feature, configured through macOS profiles rather than Windows disk encryption settings. Intune's Windows encryption policy offers BitLocker and, on mobile, Personal Data Encryption. FileVault would be the correct choice for managing Mac devices enrolled in Intune, not Windows.
- ✗
APFS encryption
Why it's wrong here
APFS encryption is Apple's file-system encryption used on macOS and iOS devices, not a Windows disk encryption setting. Intune's Windows encryption policy provides BitLocker and Personal Data Encryption. APFS encryption would be relevant when managing Apple devices, not Windows endpoints.
Go deeper
Related to this question
Learn chapter
Implementing App Protection Policies (MAM)
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
Key term
BitLocker
BitLocker is a full-disk encryption feature built into Windows that protects data by encrypting the entire drive so that unauthorized users cannot access files without the correct recovery key.
About these practice questions
This MD-102 question is part of Courseiva's 556-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.