The answer is that the devices have TPM version 1.2 instead of 2.0. This is the most likely reason because Windows 11 and its default BitLocker policy in Microsoft Intune require a TPM 2.0 chip to support the TPM protector for system drive encryption; TPM 1.2 is not compatible with this configuration, as Microsoft mandates TPM 2.0 for BitLocker’s TPM-only protector on Windows 11. On the MD-102 exam, this scenario tests your understanding of the BitLocker TPM requirement for Windows 11 Intune deployments—a common trap is assuming any TPM version suffices, but the policy specifically enforces 2.0. Remember that while TPM 1.2 can work with BitLocker on older OS versions, Windows 11 Intune policies default to requiring TPM 2.0 for the TPM protector. Memory tip: “Two-point-oh for the pro, one-point-two won’t do” — TPM 2.0 is mandatory for the BitLocker TPM protector in Windows 11 Intune.
MD-102 Prepare infrastructure for devices Practice Question
This MD-102 practice question tests your understanding of prepare infrastructure for devices. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are planning a Windows 11 deployment using Microsoft Intune. The organization has a requirement that all devices must have BitLocker enabled with a TPM protector. You configure a BitLocker policy in Intune. However, some devices report that BitLocker is not enabled. What is the most likely reason?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The devices have TPM version 1.2 instead of 2.0.
The most likely reason is that the devices have TPM version 1.2 instead of 2.0. BitLocker requires a TPM 2.0 chip to support the TPM protector when using the default Intune policy settings; TPM 1.2 is not supported for this configuration in Windows 11, as Microsoft requires TPM 2.0 for BitLocker system drive encryption with a TPM protector.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The devices have TPM version 1.2 instead of 2.0.
Why this is correct
Windows 11 requires TPM 2.0 for BitLocker.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The devices are not joined to Microsoft Entra ID.
Why it's wrong here
Entra ID join is not required for BitLocker policy.
✗
The BitLocker policy is configured only for Windows 11 Enterprise devices.
Why it's wrong here
The scenario does not mention edition restriction.
✗
The devices are running Windows 10 instead of Windows 11.
Why it's wrong here
BitLocker works on Windows 10 as well.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may assume the issue is OS version (Windows 10 vs 11) or Entra ID join status, but the core requirement is TPM 2.0, which is a hardware prerequisite for Windows 11 and BitLocker TPM protector enforcement in Intune.
Trap categories for this question
Scenario analysis trap
The scenario does not mention edition restriction.
Detailed technical explanation
How to think about this question
Under the hood, BitLocker uses the TPM to securely store the encryption key; TPM 2.0 is mandatory for Windows 11 due to its enhanced cryptographic capabilities and support for the SHA-256 algorithm, whereas TPM 1.2 uses SHA-1 and is not compatible with the default Intune BitLocker policy that requires TPM 2.0. In a real-world scenario, if an organization has older hardware with TPM 1.2, they must either upgrade the TPM firmware or configure a custom policy that allows a startup key or PIN instead of a TPM-only protector.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MD-102 question in full detail.
Prepare infrastructure for devices — This question tests Prepare infrastructure for devices — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The devices have TPM version 1.2 instead of 2.0. — The most likely reason is that the devices have TPM version 1.2 instead of 2.0. BitLocker requires a TPM 2.0 chip to support the TPM protector when using the default Intune policy settings; TPM 1.2 is not supported for this configuration in Windows 11, as Microsoft requires TPM 2.0 for BitLocker system drive encryption with a TPM protector.
What should I do if I get this MD-102 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.