MD-102 Protect devices Practice Question
You are the endpoint administrator for Contoso Ltd., a global company with 5,000 Windows 11 devices managed by Microsoft Intune. The company has a strict security policy requiring that all devices must have BitLocker Drive Encryption enabled on the operating system drive. Additionally, devices must be compliant with the policy to access corporate resources via Conditional Access. Recently, an audit revealed that 200 devices are non-compliant because BitLocker is not enabled. You investigate and find that these devices are all personal devices enrolled as 'Windows bring your own device' (BYOD). The BitLocker policy is configured as a device configuration profile targeting 'All Devices'. The compliance policy requires 'Storage encryption' to be enabled. You need to resolve the non-compliance for these BYOD devices. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upgrade the Windows edition on BYOD devices to Windows Pro or Enterprise.
BitLocker Drive Encryption is only available on Windows Pro, Enterprise, or Education editions. BYOD devices often run Windows Home, which does not support BitLocker. Upgrading to Windows Pro or Enterprise enables BitLocker, resolving the non-compliance. Option A is incorrect because the profile is already assigned to 'All Devices', but it cannot enable BitLocker on unsupported editions. Option C is incorrect as it would bypass the security requirement. Option D is incorrect because compliance policies cannot override device capabilities; they can only require encryption on devices that support it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the BitLocker configuration profile to device groups that include BYOD devices.
Why it's wrong here
The policy is already assigned to all devices.
- ✓
Upgrade the Windows edition on BYOD devices to Windows Pro or Enterprise.
Why this is correct
BitLocker is only available on Pro/Enterprise editions; upgrading enables encryption.
- ✗
Create a separate compliance policy for BYOD devices that does not require storage encryption.
Why it's wrong here
This would weaken security and might not meet company policy.
- ✗
Configure the compliance policy to mark devices as compliant if BitLocker is not enabled but other settings are met.
Why it's wrong here
Compliance policies cannot ignore encryption requirements.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Device configuration
Device configuration is the process of setting up and customizing the operating system, security policies, applications, and network settings on a device so it can securely connect to and function within an organization's IT environment.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.