Microsoft MD-102 Practice Exam
Microsoft Endpoint Administrator MD-102
The Microsoft Endpoint Administrator MD-102 exam validates the skills to deploy, manage and secure endpoints in a Microsoft 365 tenant by using Microsoft Intune. It is weighted across five domains: prepare infrastructure for devices at 20 to 25 percent, manage and maintain devices at 25 to 30 percent, protect devices at 15 to 20 percent, manage and secure applications at 15 to 20 percent, and optimize endpoint operations at 10 to 15 percent. Questions test Autopilot, enrollment, compliance, Conditional Access, updates and app protection. This practice exam mirrors that scope with scenario-based single-answer and multiple-answer questions and drag-and-drop matching, each with a worked explanation.
Question bank updated : questions, answers, explanations and chapters.
Certification Overview
- Exam name: MD-102
- Vendor: Microsoft
- Exam code: MD-102
- Duration: 100 minutes
- Total questions: about 55
- Official passing score: 700 on a scale of 1 to 1,000 (source)
- Our practice exam pass mark: 70%
Who Should Take This Exam?
Endpoint Administrator, Desktop Administrator, Intune Administrator, Modern Workplace Engineer, Device Management Engineer, Systems Administrator, IT Support Engineer, Microsoft 365 Administrator
Prerequisites
No formal prerequisite. Microsoft expects experience with Microsoft Entra ID, Microsoft 365 and Intune, and strong skills deploying and maintaining Windows client and non-Windows devices.
Topics Covered
- Prepare infrastructure for devices
- Manage and maintain devices
- Protect devices
- Manage and secure applications
- Optimize endpoint operations by using automation, monitoring, and reporting
Question Types
- Multiple Choice (Single Answer)
- Multiple Choice (Multiple Answers)
- Drag and Drop
MD-102 Practice Questions
Our question bank contains 658+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With a subscription, you get unlimited practice exams with randomised questions from our full question bank.
Prepare infrastructure for devices
A contractor uses a personal Windows 11 laptop signed in with a Microsoft account and needs to open a few company apps protected by Conditional Access. How should the laptop be associated with the tenant?
- A. Microsoft Entra registered Correct answer
- B. Microsoft Entra hybrid joined
- C. Microsoft Entra joined
- D. Domain joined to AD DS
Option A is correct because a personal device that only needs access to a few company apps should be Microsoft Entra registered (Workplace Join), which adds the account without taking over the device. Entra joined and hybrid joined are for organization-owned devices, and a personal Windows 11 laptop signed in with a Microsoft account is not a candidate for AD DS domain join.
Only members of the IT-Deploy group may join Windows devices to Microsoft Entra ID. Which Device settings change meets this requirement?
- A. Require multifactor authentication to join devices in Device settings
- B. Limit Users may join devices to Microsoft Entra to the IT-Deploy group Correct answer
- C. Limit Users may register their devices to the IT-Deploy group
- D. Limit Additional local administrators to the IT-Deploy group
Option B is correct because the Users may join devices to Microsoft Entra setting in Device settings can be scoped to a selected group such as IT-Deploy. The register setting controls registration, not join, additional local administrators controls local admin rights, and MFA to join is a separate toggle that does not restrict who may join.
Which Windows 11 edition cannot be joined to Microsoft Entra ID?
- A. Windows 11 Home Correct answer
- B. Windows 11 Education
- C. Windows 11 Pro
- D. Windows 11 Enterprise
Option A is correct because Windows 11 Home cannot be joined to Microsoft Entra ID or an AD DS domain. Pro, Enterprise and Education all support Entra join.
Which two actions can an Intune compliance policy run automatically against a device that falls out of compliance? (Choose two.)
- A. Disable the device object in Microsoft Entra ID
- B. Send an email to the end user Correct answer
- C. Retire the noncompliant device Correct answer
- D. Reset the primary user's password
- E. Wipe the device
Options B and C are correct because Intune noncompliance actions include sending an email to the end user and retiring the noncompliant device, alongside marking the device noncompliant, sending push notifications and remotely locking it. Intune has no automatic action that disables the Entra device object, resets a user's password, or wipes the device.
Manage and maintain devices
Which value must be collected from an existing Windows device before it can be registered with Windows Autopilot?
- A. The Intune managed device ID
- B. The BitLocker recovery key ID
- C. The Microsoft Entra device ID
- D. The device hardware hash Correct answer
Option D is correct because Autopilot identifies a device by its hardware hash, which must be collected from the existing device and uploaded to register it. The Intune device ID, BitLocker recovery key ID and Entra device ID are created after enrollment or join and cannot be used to pre-register a device.
Which Intune profile type lets an administrator pick individual settings from a searchable list of Windows policies instead of filling in a fixed template?
- A. Device restrictions
- B. Administrative templates
- C. Custom (OMA-URI)
- D. Settings catalog Correct answer
Option D is correct because the settings catalog exposes the full list of Windows settings in a searchable picker where the administrator chooses individual settings. Device restrictions is a fixed template, Administrative templates covers only ADMX-backed policies in a hierarchy, and Custom (OMA-URI) requires hand-entering CSP paths.
A departing employee keeps a personally owned Windows 11 laptop that is enrolled in Intune with company apps and mail. Which remote action removes the organization's data and apps while leaving the employee's personal files in place?
- A. Wipe
- B. Autopilot Reset
- C. Retire Correct answer
- D. Fresh start
Option C is correct because Retire removes company data, apps and the management relationship while leaving personal data untouched, which suits a personally owned device. Wipe and Fresh start remove personal data too, and Autopilot Reset returns a corporate device to a ready-to-use state.
Which TWO hardware requirements must a PC meet to be eligible for an in-place upgrade to Windows 11? (Choose two.)
- A. A discrete graphics card with 4 GB of video memory
- B. 128 GB of storage
- C. UEFI firmware with Secure Boot capability Correct answer
- D. TPM version 2.0 Correct answer
- E. 8 GB of system memory
Options C and D are correct because an in-place upgrade to Windows 11 requires UEFI firmware with Secure Boot capability and TPM 2.0. A discrete GPU is not required (DirectX 12 compatible graphics is enough), and the minimums are 4 GB of RAM and 64 GB of storage, so 8 GB and 128 GB are not requirements.
Protect devices
Which Intune policy type configures BitLocker Drive Encryption settings for Windows 11 devices?
- A. App protection policy
- B. Device restrictions profile
- C. Disk encryption policy Correct answer
- D. Windows Autopilot deployment profile
Option C is correct because BitLocker settings for Windows 11 are configured with a disk encryption policy under Endpoint security in Intune. App protection policies secure app data, device restrictions profiles do not manage BitLocker encryption, and Autopilot deployment profiles only control provisioning.
An administrator wants to delay monthly Windows quality updates by seven days on a group of Windows 11 devices. Which Intune policy type provides this setting?
- A. Feature updates policy for Windows 10 and later
- B. Device compliance policy
- C. Update ring for Windows 10 and later Correct answer
- D. Security baseline for Windows
Option C is correct because an update ring for Windows 10 and later lets you set a quality update deferral period of up to 30 days. A feature updates policy targets feature versions, a compliance policy only evaluates state, and a security baseline does not control update deferral.
Microsoft publishes preconfigured groups of recommended security settings that Intune can deploy to Windows devices. What are these called?
- A. Administrative templates
- B. Device restrictions profiles
- C. Custom OMA-URI profiles
- D. Security baselines Correct answer
Option D is correct because security baselines are Microsoft-recommended, preconfigured groups of security settings that Intune can deploy to Windows devices. Administrative templates, device restrictions profiles and custom OMA-URI profiles are configuration tools where you pick the settings yourself.
An administrator creates an Account protection policy under Endpoint security for Windows 11 devices. Which TWO features can this policy configure? (Choose two.)
- A. Microsoft Defender Antivirus cloud-delivered protection
- B. Credential Guard Correct answer
- C. BitLocker drive encryption for operating system drives
- D. Windows Hello for Business settings Correct answer
- E. Windows Firewall rules for the domain network profile
Options B and D are correct because the Account protection policy under Endpoint security is built for user credentials: it configures Credential Guard and Windows Hello for Business settings. Microsoft Defender Antivirus cloud protection belongs to the Antivirus policy, BitLocker to the Disk encryption policy, and Windows Firewall rules to the Firewall policy.
Manage and secure applications
Before a legacy installer can be uploaded to Intune as a Win32 app, it must be converted to the .intunewin format. Which tool performs the conversion?
- A. Windows Configuration Designer
- B. Microsoft Deployment Toolkit
- C. Win32 Content Prep Tool Correct answer
- D. PSAppDeployToolkit
Option C is correct because the Win32 Content Prep Tool (IntuneWinAppUtil.exe) packages the installer and its source folder into the .intunewin format that Intune requires for Win32 apps. Windows Configuration Designer builds provisioning packages, Microsoft Deployment Toolkit builds task-sequence deployments, and PSAppDeployToolkit is a scripting wrapper for installs; none of them create .intunewin files.
To deploy Microsoft 365 Apps for enterprise to Windows 11 laptops without building an installer package, which app type does the administrator add in the Intune admin center?
- A. Microsoft 365 Apps (Windows 10 and later) Correct answer
- B. Microsoft Store app (new)
- C. Windows app (Win32)
- D. Line-of-business app
Option A is correct because the Microsoft 365 Apps (Windows 10 and later) app type has Intune deliver Microsoft 365 Apps for enterprise from the Office CDN with built-in configuration settings, so no installer needs to be packaged. Win32 and line-of-business types require you to supply a package, and the Microsoft Store app (new) type is for Store apps, not Microsoft 365 Apps.
An administrator wants to stop users from saving corporate files from managed apps to personal cloud storage on unenrolled phones. Which Intune policy type provides this control?
- A. Device restrictions profile
- B. Device compliance policy
- C. App protection policy Correct answer
- D. App configuration policy
Option C is correct because app protection policies (MAM) control data movement such as Save copies of org data and cut, copy, and paste inside managed apps, and they work on unenrolled devices. Device restrictions and compliance policies need an enrolled device, and app configuration policies supply app settings rather than data-protection controls.
Contoso will distribute public store apps to corporate iPhones and to Android Enterprise fully managed phones through Intune. Which TWO tasks connect the tenant to the app stores for these two platforms? (Choose two.)
- A. Link the tenant to a managed Google Play account Correct answer
- B. Upload an Apps and Books location token from Apple Business Manager Correct answer
- C. Upload an Apple Push Notification service certificate to license store apps
- D. Connect an Android Management API service account from a Google Cloud project
- E. Add the Apple Business Manager account as an automated device enrollment token
Options A and B are correct because public store apps reach Android Enterprise fully managed phones through a managed Google Play account linked to the tenant, and reach iPhones through an Apps and Books (VPP) location token uploaded from Apple Business Manager. Option C is wrong because the APNs certificate enables device management, not app licensing. Option D describes the legacy Android Management API service account approach rather than the managed Google Play link, and option E is the token used for automated device enrollment, not for apps.
Optimize endpoint operations by using automation, monitoring, and reporting
Which module should an administrator install to script bulk Intune tasks through the Microsoft Graph API?
- A. Exchange Online PowerShell module
- B. Configuration Manager console module
- C. Azure Resource Graph extension
- D. Microsoft Graph PowerShell SDK Correct answer
Option D is correct because the Microsoft Graph PowerShell SDK is the module that calls Microsoft Graph, which is the API behind Intune, so it is used to script bulk Intune tasks. The Exchange Online module manages mailboxes, the Configuration Manager module targets on-premises ConfigMgr, and Azure Resource Graph queries Azure resources, not Intune.
Microsoft Entra joined Windows 11 devices at a logistics firm need a PowerShell script that writes an HKLM registry value. No user will be signed in when it runs. What should the administrator configure?
- A. Platform script on the device group, run as the signed-in user
- B. Shell script assigned to the device group
- C. Platform script on the device group, run as system Correct answer
- D. GPO logon script linked to the device OU
Option C is correct because a platform script run in the system context (logged-on credentials set to No) can write to HKLM when nobody is signed in, and it is assigned to the device group. Option A needs a signed-in user and user rights, Option B is for macOS, and Option D relies on on-premises GPO, which does not apply to Entra joined devices.
A bank must mark Windows 11 devices noncompliant when a line-of-business agent's service is not running, a condition no built-in compliance setting covers. Which two items does the custom compliance configuration need? (Choose two.)
- A. A Win32 app that packages the check and reports its exit code
- B. A JSON file that defines the rules and noncompliance messages Correct answer
- C. A Settings catalog profile that writes the service state to the registry
- D. A detection and remediation script pair in Scripts and remediations
- E. A PowerShell discovery script that returns the service state as JSON Correct answer
Options B and E are correct because custom compliance needs a discovery script that runs on the device and returns the service state as JSON, plus a JSON rules file that defines the compliant values and the noncompliance messages. A Win32 app, a Settings catalog profile and a remediation script pair do not feed values into the compliance policy.
Users whose Windows laptops become noncompliant must receive an email from Intune explaining why. Which two items does the administrator set up? (Choose two.)
- A. A Power Automate flow triggered when a device is marked noncompliant
- B. A device restrictions profile that turns on Windows notifications
- C. A notification message template with subject and body text Correct answer
- D. A Send email to end user action in the compliance policy Correct answer
- E. A Conditional Access session control that shows a warning page
Options C and D are correct because the email content comes from a notification message template, and the compliance policy must contain a Send email to end user action that uses that template. Power Automate, a device restrictions profile and Conditional Access session controls are not how Intune sends noncompliance email.
Free Study Guide
Read the free Microsoft MD-102 study guide: every exam topic explained in plain English, with diagrams, exam tips and the mistakes to avoid.
More Microsoft Practice Exams
- Microsoft AI-103 Practice Exam
- Microsoft AI-200 Practice Exam
- Microsoft AI-901 Practice Exam
- Microsoft AZ-104 Practice Exam
- Microsoft AZ-305 Practice Exam
- Microsoft AZ-400 Practice Exam
- Microsoft AZ-900 Practice Exam
- Microsoft DP-600 Practice Exam
- Microsoft DP-700 Practice Exam
- Microsoft DP-900 Practice Exam
- Microsoft PL-300 Practice Exam
- Microsoft SC-100 Practice Exam
Practise with realistic mock exams to prepare for your Microsoft certification.