EarnYourCert
Exams › MD-102 › Domain 2 of 5
MD-102 · Domain 2 of 5 · 25-30% of the exam

Manage and maintain devices

Domain 2 of MD-102 accounts for 25-30% of the exam, the heaviest part of the syllabus. EarnYourCert has 188 original questions for this domain, all with explanations: 127 multiple choice, 31 yes/no and 30 completion or ordering items, like the real exam.

Practice domain 2 for free →No sign-up. Choose how many questions you want.

Domain 2 sample questions

8 questions from our 188-question bank for this domain. Try to answer before revealing the solution.

1. What information must the CSV file contain that is imported to register devices in the Windows Autopilot service?

  1. Device name, assigned user as primary owner, and local administrator account password of the device
  2. Device hardware hash, serial number, and (optionally) order identifier and Autopilot group tag
  3. Current device IP address, computer name in the domain, and BitLocker recovery password stored in Entra ID
  4. Active Windows license number, physical device serial number, and exact purchase date from manufacturer or OEM
Show answer

Correct answer: B. The Autopilot CSV contains: hardware hash (unique device identifier), serial number, order identifier (optional), and group tag (optional). The hash is generated with Get-WindowsAutoPilotInfo.

2. Autopilot devices joined to Microsoft Entra ID must be named with the prefix CTS- followed by the serial number. Where do you configure this?

  1. In a dynamic group rule that renames members by serial
  2. In the device name template of the deployment profile
  3. In the Enrollment Status Page with a custom message
  4. In a compliance policy that checks the device name
Show answer

Correct answer: B. For Entra join, the Autopilot deployment profile's 'Apply device name template' setting supports macros such as %SERIAL% and %RAND:x% (for example CTS-%SERIAL%), with a 15-character limit.

3. You want to create an Intune configuration profile for macOS devices that configures the corporate mail server. What type of profile should you create?

  1. Device restrictions
  2. Email
  3. SCEP certificate
  4. VPN
Show answer

Correct answer: B. The 'Email' profile type allows configuring mail accounts on mobile and desktop devices, including the server, protocol (Exchange ActiveSync, etc.) and credentials.

4. Before moving to Intune, you want to know which of your existing GPO settings have an MDM equivalent. Which tool should you use?

  1. Group Policy analytics with an imported GPO backup XML
  2. Endpoint analytics startup performance reports per model
  3. Microsoft Purview Compliance Manager assessments
  4. The Windows Update for Business compliance report
Show answer

Correct answer: A. Group Policy analytics imports GPO backup XML files, shows which settings are supported in MDM and can migrate supported settings into a Settings catalog profile.

5. What does Microsoft Intune Advanced Analytics allow that is impossible with standard Intune reports?

  1. View the complete list of all devices enrolled in Intune with their current enrollment status and last sync date and time
  2. Predict likely hardware failures from telemetry trends and run real-time KQL queries on devices
  3. Create fully customized device performance reports with Microsoft Power BI using Intune data as the primary data source
  4. View detailed compliance status of all devices with active security policies and their risk levels in Microsoft Intune
Show answer

Correct answer: B. Advanced Analytics offers predictive analytics (identify failure-prone devices before they fail), user experience analytics, real-time KQL queries, and anomaly analysis not available in standard reports.

6. An administrator needs to retrieve the BitLocker recovery key for a Windows device enrolled in Intune. Where can they find it in the Intune portal?

  1. Endpoint security > Disk encryption policies
  2. Devices > select the device > Recovery keys
  3. Reports > Device encryption
  4. Microsoft Entra ID > Devices > select the device > BitLocker keys
Show answer

Correct answer: B. In the Intune portal, by navigating to Devices > select the specific device > Recovery keys, the administrator can view the BitLocker recovery key stored in Intune.

7. Which query language is used to run device queries (Device query) in Intune Advanced Analytics?

  1. SQL (Structured Query Language) with Microsoft Azure Monitor extensions
  2. KQL (Kusto Query Language)
  3. PowerShell with Microsoft Graph modules for device inventory queries
  4. OData with REST filters for querying device properties in Intune
Show answer

Correct answer: B. Device queries in Intune Advanced Analytics use KQL (Kusto Query Language), the same language used in Microsoft Defender, Azure Monitor, and other Microsoft services.

8. Which Intune remote action allows getting the installed software inventory, running processes, and registry configuration of a specific Windows device in real time?

  1. Collect diagnostics to download device log files
  2. Device query using KQL in Intune Advanced Analytics
  3. Run a predefined software inventory PowerShell script from the Intune scripts section
  4. Sync the device and view detailed hardware properties in the portal properties section
Show answer

Correct answer: B. Device query with KQL in Advanced Analytics allows real-time querying of a device's state: installed software, processes, services, registry keys, local users, and much more.

Other MD-102 domains