Microsoft MD-102 Practice Test 1

Question 1

A staff member uses a personal Windows laptop for company SaaS but IT must not claim its operating-system ownership. Which configuration BEST meets this requirement?

Create a dynamic Microsoft Entra device group using the ownership property.
Register the personal Windows device in Microsoft Entra ID.
Microsoft Entra join the corporate Windows laptops.
Configure Microsoft Entra hybrid join for eligible domain clients.

Explanation

Correct Answer

Registration associates a user-owned device with the tenant without replacing its local sign-in authority. It directly addresses identity association for BYOD.

Incorrect Answers

Dynamic membership evaluates device attributes rather than relying on manual group curation. That suits automatic corporate device grouping, whereas this device needs identity association for BYOD.

Cloud join makes Entra ID the primary device identity for organization-owned Windows clients. Its role is cloud-native device join; this case requires identity association for BYOD.

Hybrid join retains AD DS membership while registering the device in Entra ID. This is appropriate for dual on-premises and cloud device identity, not the specified identity association for BYOD.

Question 2

A newly built cloud-managed Windows PC fails join because it cannot contact the Entra device registration service. Which device-management decision is MOST appropriate?

Delete the obsolete registered device object after entitlement review.
Verify the device was joined to the intended Entra tenant and directory.
Restore required Microsoft Entra registration endpoint connectivity.
Inspect device join status with dsregcmd /status.

Explanation

Correct Answer

Join requires TLS reachability to tenant device-registration services before enrollment can proceed. It directly addresses cloud join service reachability.

Incorrect Answers

Removing stale device identities reduces abandoned registration surfaces without wiping unrelated personal data. The choice addresses retired device identity cleanup rather than cloud join service reachability.

Tenant context determines where a join creates the directory device object. It solves correct tenant device registration; the actual goal is cloud join service reachability.

The device-state output distinguishes cloud join, workplace registration, and hybrid join indicators. That suits evidence of Windows join state, whereas this device needs cloud join service reachability.

Question 3

IT needs to hand-pick four known kiosks into one assignment group without any attribute pattern. Which approach addresses the stated endpoint-management need?

Use a dynamic device-membership rule based on the supported category.
Target each applicable device group explicitly in the Intune assignment.
Revise and validate the device dynamic-rule expression against current attributes.
Use an assigned Microsoft Entra device security group.

Explanation

Correct Answer

Assigned membership explicitly includes nominated devices without dynamic rules. It directly addresses curated static membership.

Incorrect Answers

Dynamic rules evaluate declared attributes for future matching devices. It solves self-maintaining category membership; the actual goal is curated static membership.

Multiple explicit group assignments avoid assuming nested device groups are expanded by every workload. Its role is predictable multi-group targeting; this case requires curated static membership.

Membership rules depend on matching actual stored values, not the former naming expectation. This is appropriate for corrected attribute-based inclusion, not the specified curated static membership.

Question 4

A cloud workstation joins the tenant but an administrator needs to confirm it is also managed by Intune. Which configuration BEST meets this requirement?

Inspect its management authority and MDM enrollment state separately.
Evaluate its Intune compliance record independently of registration.
Check the device trust state against the required hybrid-join grant condition.
Reconcile obsolete and replacement device objects by verified device identifiers.

Explanation

Correct Answer

Device join alone does not establish an active MDM management enrollment. It directly addresses distinguishing join from management.

Incorrect Answers

Registration is an identity state; compliance requires applicable evaluated policy evidence. This is appropriate for evidence-based compliance status, not the specified distinguishing join from management.

A registered-only device does not satisfy a hybrid-joined device requirement. That suits correct trust grant matching, whereas this device needs distinguishing join from management.

Device identities should track actual endpoint lifecycle rather than a reused friendly name. The choice addresses nonambiguous device inventory identity rather than distinguishing join from management.

Question 5

Admin policy must target Windows endpoints with a specific manufacturer regardless of the user's department. Which device-management decision is MOST appropriate?

Add an assignment filter restricting supported device ownership values.
Use device attributes in a supported Intune assignment filter.
Assign policy to the staff user group.
Correlate the appropriate device and hardware identifiers across records.

Explanation

Correct Answer

Device filters refine assignment using device properties rather than employee identity. It directly addresses hardware-based assignment refinement.

Incorrect Answers

Filtering an existing broad assignment limits the actual applicable device population. Its role is ownership-limited deployment scope; this case requires hardware-based assignment refinement.

User targeting follows the person across their eligible managed endpoints. The choice addresses employee-scoped assignment rather than hardware-based assignment refinement.

Stable identifiers avoid confusing renamed or recycled device display names. It solves reliable hardware inventory correlation; the actual goal is hardware-based assignment refinement.

Question 6

A new device join attempt fails because the user exceeded the tenant device-registration limit. Which approach addresses the stated endpoint-management need?

Correct tenant enrollment and join configuration before re-running provisioning.
Diagnose and clean up the obsolete device registration before rejoining.
Review and adjust device join limits or retire unused device records.
Correct the tenant device-join permission assignment for authorized users.

Explanation

Correct Answer

Tenant join restrictions can prevent an otherwise eligible user from adding another device. It directly addresses device registration limit handling.

Incorrect Answers

Provisioning tenant identifiers must point to the organization that owns the endpoint. This is appropriate for tenant-consistent provisioning, not the specified device registration limit handling.

Old registration state may conflict with the intended fresh tenant relationship. That suits clean tenant transition, whereas this device needs device registration limit handling.

Device join authorization is enforced independently of credential validity. Its role is permitted device join population; this case requires device registration limit handling.

Question 7

A purchased laptop is to become a corporate cloud device with centrally managed authentication. Which configuration BEST meets this requirement?

Use Microsoft Entra device registration without corporate join.
Use supported Microsoft Entra hybrid join.
Remove the stale device identity and revoke dependent access as appropriate.
Use Microsoft Entra join as the corporate join state.

Explanation

Correct Answer

Entra join establishes tenant-owned device identity for cloud-managed Windows endpoints. It directly addresses corporate cloud identity.

Incorrect Answers

Registration provides workplace association while retaining personal device ownership. That suits nonintrusive personal registration, whereas this device needs corporate cloud identity.

Hybrid join links AD domain membership with a cloud-registered trust state. The choice addresses legacy domain continuity with cloud trust rather than corporate cloud identity.

Lifecycle cleanup prevents former corporate hardware from retaining a valid device identity. It solves disposal-stage device trust removal; the actual goal is corporate cloud identity.

Question 8

A dynamic device group unexpectedly contains Android tablets as well as Windows laptops. Which device-management decision is MOST appropriate?

Add a valid operating-system condition to the dynamic membership rule.
Use assigned membership with an auditable approval process.
Inspect rule evaluation and allow for documented membership reprocessing.
Combine supported rule conditions with the logical AND operator.

Explanation

Correct Answer

A platform predicate can exclude unrelated devices before policy assignment. It directly addresses OS-specific dynamic membership.

Incorrect Answers

Manual group control allows intentional review instead of automatically trusting matching attributes. It solves human-approved group membership; the actual goal is OS-specific dynamic membership.

Dynamic rule results are derived from device attributes and evaluation timing. Its role is dynamic-membership explanation; this case requires OS-specific dynamic membership.

Conjunctive group logic selects devices satisfying both attributes. This is appropriate for dual-attribute cohort selection, not the specified OS-specific dynamic membership.

Question 9

An admin needs to see whether Windows is Entra joined or only workplace registered. Which approach addresses the stated endpoint-management need?

Verify the tenant and device IDs in local and directory records.
Run and interpret dsregcmd device-state diagnostics.
Start the supported MDM enrollment workflow for that managed device.
Inspect evaluated Intune device compliance rather than relying on directory presence.

Explanation

Correct Answer

Device-state flags expose the distinction between AzureAdJoined and WorkplaceJoined. It directly addresses Windows registration diagnosis.

Incorrect Answers

Tenant-scoped identifiers distinguish similar computer names across organizations. The choice addresses authoritative tenant linkage rather than Windows registration diagnosis.

A directory record does not automatically install the management service. This is appropriate for independent MDM onboarding, not the specified Windows registration diagnosis.

Intune compliance results represent assessment against configured device rules. That suits evaluated security posture, whereas this device needs Windows registration diagnosis.

Question 10

Every device assigned to a small named executive security cohort is chosen individually by IT. Which configuration BEST meets this requirement?

Target the applicable Microsoft Entra user security group.
Configure an Intune device filter to exclude personal ownership.
Use manually assigned device-group membership.
Use dynamic device-group membership using the category value.

Explanation

Correct Answer

Explicit device membership maps directly to a curated asset list. It directly addresses handpicked hardware cohort.

Incorrect Answers

User-scoped policy follows authorized staff rather than a fixed hardware list. It solves people-oriented assignment; the actual goal is handpicked hardware cohort.

Assignment filtering removes unwanted hardware classes from a broad target. Its role is broad group with ownership exclusion; this case requires handpicked hardware cohort.

Attribute evaluation captures newly eligible devices without operator edits. The choice addresses automatic future category inclusion rather than handpicked hardware cohort.