MD-102 Prepare infrastructure for devices Practice Question
You are designing a device management strategy for a remote workforce using Windows 10 laptops that are Azure AD joined. You need to ensure that devices can be remotely wiped if lost or stolen, and that BitLocker recovery keys are escrowed to Azure AD. Which THREE configurations should you implement?
⚠ Common exam trap
The trap here is that candidates might think Group Policy (Option C) is sufficient for Azure AD-joined devices, but Group Policy only works with on-premises AD and cannot escrow keys to Azure AD, while Intune's BitLocker policy is the correct cloud-native approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a BitLocker policy in Intune that enables key escrow to Azure AD.
Intune's BitLocker policy includes a setting to automatically store recovery keys in Azure AD, which is essential for key escrow. This integration ensures that if a device is lost or stolen, administrators can retrieve the recovery key from Azure AD to access encrypted data or perform a remote wipe. Without this policy, BitLocker keys would not be escrowed to Azure AD even if the device is enrolled in Intune.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Join devices to on-premises Active Directory.
Why it's wrong here
Not required for key escrow to Azure AD.
- ✓
Configure a BitLocker policy in Intune that enables key escrow to Azure AD.
Why this is correct
Key escrow stores recovery keys in Azure AD.
- ✗
Configure a Group Policy to escrow BitLocker keys to Active Directory.
Why it's wrong here
This escrows to on-prem AD, not Azure AD.
- ✓
Enroll devices in Microsoft Intune.
Why this is correct
Intune provides remote wipe capability.
- ✓
Ensure devices are Azure AD joined.
Why this is correct
Azure AD join is required for key escrow to Azure AD.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
BitLocker
BitLocker is a full-disk encryption feature built into Windows that protects data by encrypting the entire drive so that unauthorized users cannot access files without the correct recovery key.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.