MD-102 Exam — Questions and Answers

Question 1: An organization uses a Connected Cache server (Microsoft Connected Cache) with Delivery Optimization. What is the primary benefit of this configuration?

A cache server on the local network serves update content to devices, reducing WAN bandwidth usage (Correct answer)
Updates are encrypted end-to-end between the cache and devices
Devices receive updates faster because Microsoft prioritizes cached content delivery
Connected Cache replaces the need for Windows Server Update Services (WSUS)

Correct answer: A cache server on the local network serves update content to devices, reducing WAN bandwidth usage

Microsoft Connected Cache places a cache server on the organization's local network that serves update content to devices locally, significantly reducing WAN bandwidth consumption for update distribution.

Question 2: An admin wants to enroll Android devices in a mode where the company owns and fully manages the entire device. Which enrollment type should be used?

Android Enterprise work profile
Android Enterprise dedicated
Android device administrator
Android Enterprise fully managed (Correct answer)

Correct answer: Android Enterprise fully managed

Android Enterprise fully managed enrollment gives the organization complete control over the entire device, typically used for corporate-owned devices with a single primary user.

Question 3: Which Windows 11 feature allows Microsoft to automatically pause updates on a device if a compatibility issue is detected?

Quality pause
Feature block
Update compliance hold
Safeguard hold (Correct answer)

Correct answer: Safeguard hold

Safeguard holds are automatically applied by Microsoft to prevent a device from receiving an update if a known compatibility issue exists for that hardware or software configuration.

Question 4: Which Intune feature allows IT to detect non-compliant device configurations and automatically remediate them using custom scripts?

Proactive remediations (Remediations) (Correct answer)
Endpoint security baselines
Device compliance policy
PowerShell scripts

Correct answer: Proactive remediations (Remediations)

Proactive remediations (now called Remediations) in Intune run detection and remediation script pairs to identify and fix configuration issues on managed Windows endpoints.

Question 5: Which Intune feature allows administrators to run queries on managed device inventory and configuration data using KQL?

Intune Data Warehouse (Correct answer)
Endpoint analytics
Advanced hunting in Microsoft Intune (via MDE integration)
Microsoft Defender hunting

Correct answer: Intune Data Warehouse

The Intune Data Warehouse provides historical device and compliance data that can be queried using Power BI or OData feeds, while advanced hunting uses KQL in Microsoft 365 Defender.

Question 6: A Windows 10 device is Azure AD joined. A user wants to use Windows Hello for Business. What is required for cloud-only deployments?

Active Directory Certificate Services
Azure AD Premium P1 license (Correct answer)
On-premises PKI infrastructure
Active Directory Federation Services

Correct answer: Azure AD Premium P1 license

Windows Hello for Business cloud-only deployments require Azure AD Premium P1 to support the certificate trust or key trust models.

Question 7: Which Microsoft Defender feature provides a centralised view of security alerts, threats, and recommendations for managed endpoints?

Windows Security app
Microsoft Defender for Endpoint portal (Correct answer)
Microsoft Defender Antivirus dashboard
Intune Endpoint security overview

Correct answer: Microsoft Defender for Endpoint portal

The Microsoft Defender for Endpoint portal at security.microsoft.com provides a unified security operations view with device inventory, alerts, threat analytics, vulnerability management, and attack surface reduction recommendations.

Question 8: What does the Enrollment Status Page (ESP) do during Windows Autopilot deployment?

It records the device in the Autopilot hardware hash database
It blocks the user from accessing the desktop until required apps and policies are applied (Correct answer)
It captures diagnostic logs and uploads them to Intune
It sends an email notification when enrollment is complete

Correct answer: It blocks the user from accessing the desktop until required apps and policies are applied

The Enrollment Status Page prevents the user from accessing the desktop or apps until all required configurations, applications, and policies have been successfully applied to the device.

Question 9: Which protocol does Windows Hello for Business use for authentication in a key trust deployment?

OAuth 2.0
Kerberos (Correct answer)
SAML
NTLM

Correct answer: Kerberos

Windows Hello for Business key trust uses Kerberos for on-premises authentication by leveraging the user's key credential registered in AD.

Question 10: What is the purpose of app requirement rules in Win32 app deployment in Intune?

Configure app assignment groups
Detect if the app is already installed
Define prerequisites that must be met before the app installation begins (Correct answer)
Set the minimum OS version for the device

Correct answer: Define prerequisites that must be met before the app installation begins

Requirement rules in Intune Win32 app deployment define prerequisite conditions (such as OS version, disk space, or registry keys) that must be satisfied before Intune attempts to install the app.

Question 11: You have a Microsoft 365 subscription that includes Microsoft Intune. The subscription contains corporate-owned, fully managed Android Enterprise devices. You plan to deploy a configuration profile that will have a device restrictions profile type named Profile1. Profile1 will assign maintenance windows for system updates. What should you configure from the Configuration settings for Profile1?

Device experience (Correct answer)
Connectivity
General
Power Settings Explanation

Correct answer: Device experience

For Android Enterprise corporate-owned, fully managed devices, settings related to system updates, including defining maintenance windows, are found under the "Device experience" category within a device restrictions configuration profile. This section allows administrators to control various aspects of the device's user experience and operational behavior, such as update policies, kiosk modes, and display settings.

Question 12: Which Intune app assignment type installs an application automatically without requiring user action?

Available without enrollment
Uninstall
Required (Correct answer)
Available

Correct answer: Required

The 'Required' assignment type in Intune automatically installs the application on targeted devices or users without any user intervention.

Question 13: Which Azure AD feature allows users to register their Windows 10 devices so they can access organizational resources with a personal device?

Azure AD Join
Workplace Join
Hybrid Azure AD Join
Azure AD Registered (Correct answer)

Correct answer: Azure AD Registered

Azure AD Registered is designed for personal (BYOD) devices that users register to access organizational resources without the device being fully joined to Azure AD.

Question 14: A company wants to deploy a volume-purchased iOS app to managed iPhones. Which Apple service must be integrated with Intune?

Apple Business Manager (ABM) (Correct answer)
Apple Configurator
Apple Developer Program
Apple Push Notification Service (APNs)

Correct answer: Apple Business Manager (ABM)

Apple Business Manager integration with Intune enables volume purchasing and deployment of iOS apps to corporate-managed devices through the Apps and Books purchase program.

Question 15: A company needs to allow users to join devices to Azure AD without granting them the ability to manage other users. Which setting controls the maximum number of devices a user can Azure AD join?

Conditional Access policy
Device quota per user in Azure AD (Correct answer)
Intune enrollment restriction
Device configuration profile

Correct answer: Device quota per user in Azure AD

The device quota per user setting in Azure AD > Devices > Device settings controls how many devices each user can Azure AD join.

Question 16: An organisation wants to deploy Windows to new devices without physical media, ensuring Azure AD join and Intune enrollment automatically. Which solution is best?

Windows Deployment Services (WDS)
SCCM OSD Task Sequence
MDT with PXE boot
Windows Autopilot (Correct answer)

Correct answer: Windows Autopilot

Windows Autopilot enables zero-touch deployment where devices are automatically configured, Azure AD-joined, and Intune-enrolled out of the box without physical media or on-premises infrastructure.

Question 17: Your network contains an Active Directory domain named contoso.com. The domain contains 25 computers that run Windows 11. You have a Microsoft 365 subscription You have an Azure AD tenant that syncs with contoso.com. You configure hybrid Azure AD join and discover that some of the computers have a registered state of Pending. You need to ensure that the computers complete the join successfully. What should you ensure?

that the users of the computers are assigned Microsoft 365 licenses
that the computers contain the latest quality updates
that Windows is activated on all the computers
that each computer has a line of sight to a domain controller (Correct answer)

Correct answer: that each computer has a line of sight to a domain controller

For hybrid Azure AD join to complete successfully, the computers need to be able to communicate directly with an on-premises Active Directory domain controller. This 'line of sight' is crucial for the device registration process, as the domain controller is responsible for syncing the device object to Azure AD. Without this connectivity, the device registration can remain in a 'Pending' state.

Question 18: An administrator needs to ensure that only compliant devices can access Microsoft 365 resources. Which Azure AD feature should be configured?

Privileged Identity Management
Access Reviews
Conditional Access (Correct answer)
Identity Protection

Correct answer: Conditional Access

Conditional Access policies in Azure AD can enforce that only devices marked compliant by Intune are permitted to access Microsoft 365 resources.

Question 19: You have a Microsoft 365 subscription that includes Microsoft Intune. You plan to use Windows Autopilot to deploy Windows 11 devices. You need to meet the following requirements during Autopilot provisioning: * Display the app and profile configuration progress. * Block users from using the devices until all apps and profiles are installed What should you configure?

an enrollment device platform restriction
an app configuration policy
an enrollment status page (Correct answer)
an app protection policy

Correct answer: an enrollment status page

The Enrollment Status Page (ESP) in Windows Autopilot is designed to display the progress of device setup, including app and profile configuration. It can also be configured to block users from using the device until all required applications and profiles are successfully installed. This ensures that devices are fully provisioned and compliant before users gain access, meeting both requirements.

Question 20: Which tool provides a unified view of update compliance for Windows 10 devices managed by Windows Update for Business?

Windows Update for Business reports (in Azure Monitor) (Correct answer)
Intune device compliance reports
Microsoft Defender dashboard
Endpoint analytics

Correct answer: Windows Update for Business reports (in Azure Monitor)

Windows Update for Business reports, integrated with Azure Monitor Log Analytics, provide detailed update compliance status for devices managed by WUfB.

Question 21: What is the primary requirement for a device to be eligible for Windows Autopilot?

Device must be domain-joined
Device must have Windows 11 installed
Device must have TPM 2.0
Device hardware hash must be registered in Intune/Autopilot (Correct answer)

Correct answer: Device hardware hash must be registered in Intune/Autopilot

A device's hardware hash (including device ID information) must be uploaded and registered in Windows Autopilot before it can be provisioned using Autopilot.

Question 22: An endpoint administrator configures an update ring with a 10-day feature update deferral. What is the maximum deferral period allowed for feature updates?

180 days
730 days
365 days (Correct answer)
90 days

Correct answer: 365 days

Feature updates can be deferred for up to 365 days (one year) using Windows Update for Business policies configured in Microsoft Intune.

Question 23: What are detection rules used for when deploying Win32 apps in Intune?

To specify the installation command for the app
To check if the device is compliant before installing the app
To define which users are authorized to install the app
To verify the app was successfully installed on the device (Correct answer)

Correct answer: To verify the app was successfully installed on the device

Detection rules in Intune Win32 app deployments define how Intune determines whether the application is already installed on a device, preventing redundant reinstallation.

Question 24: Which attack surface reduction rule prevents Office applications from creating executable content (such as .exe files)?

Block credential stealing from Windows LSASS
Use advanced protection against ransomware
Block Office applications from creating executable content (Correct answer)
Block executable files from running unless they meet a prevalence criterion

Correct answer: Block Office applications from creating executable content

The ASR rule 'Block Office applications from creating executable content' prevents macro-enabled Office files from writing and executing malicious payloads.

Question 25: During Windows Autopilot self-deploying mode, which authentication type is used since no user credentials are entered?

Windows Hello for Business PIN
Device certificate with TPM attestation (Correct answer)
FIDO2 security key
Azure AD user password

Correct answer: Device certificate with TPM attestation

Autopilot self-deploying mode uses the device TPM chip for attestation and a device certificate to authenticate to Azure AD without requiring user credentials.

Question 26: An administrator wants to block USB drives on corporate Windows 10 devices using Intune. Which policy type should be used?

Endpoint security – Firewall
Device compliance policy
Device configuration – Device restrictions
Endpoint security – Attack surface reduction (Correct answer)

Correct answer: Endpoint security – Attack surface reduction

Attack surface reduction policies in Intune include removable storage device controls that can block USB drives and other removable media on managed Windows devices.

Question 27: An organization uses Hybrid Azure AD Join. What tool is used to synchronize on-premises AD accounts to Azure AD?

Active Directory Migration Tool
ADFS Proxy
Azure AD Connect (Correct answer)
Azure AD App Proxy

Correct answer: Azure AD Connect

Azure AD Connect is the Microsoft tool that synchronizes on-premises Active Directory identities, including device objects, to Azure AD.

Question 28: A Windows 10 device shows as 'Not evaluated' in the Intune compliance report. What is the most likely reason?

The Intune enrollment is corrupted
The device is pending a restart
The device is not connected to the internet
The device has no compliance policies assigned (Correct answer)

Correct answer: The device has no compliance policies assigned

A 'Not evaluated' compliance status in Intune occurs when no compliance policy has been assigned to the device or user, so no evaluation has taken place.

Question 29: Which Intune app configuration policy delivery channel is used to configure settings for managed apps on enrolled devices?

MAM without enrollment
Managed apps channel
App protection policy
Managed devices channel (Correct answer)

Correct answer: Managed devices channel

App configuration policies for managed devices deliver configuration settings through the MDM channel to apps installed on enrolled Intune-managed devices.

Question 30: Which Windows Autopilot deployment mode allows IT to pre-provision a device so it is fully configured before being handed to the end user?

Hybrid join mode
Self-deploying mode
User-driven mode
Pre-provisioning mode (Correct answer)

Correct answer: Pre-provisioning mode

Pre-provisioning mode (White Glove) allows IT or a partner to complete most of the Autopilot setup before the device reaches the end user.

Question 31: A company is migrating users from Windows 10 to Windows 11 using in-place upgrades. Which Intune feature can trigger and manage these upgrades?

Endpoint security Antivirus policy
Device configuration Delivery Optimization profile
Windows Update for Business Feature Update policy (Correct answer)
Device compliance policy

Correct answer: Windows Update for Business Feature Update policy

Feature Update policies in Windows Update for Business allow administrators to define which Windows feature version devices should upgrade to and when, triggering in-place upgrades.

Question 32: Which Windows connectivity feature allows devices to sync work files from a corporate file server over HTTPS without requiring a full VPN connection?

OneDrive for Business
Work Folders (Correct answer)
BranchCache
Network Drive Mapping

Correct answer: Work Folders

Work Folders is a Windows feature that syncs files from a corporate file server to a user's device over HTTPS, without requiring a full VPN connection.

Question 33: Which prerequisite must be met on the Configuration Manager side to enable co-management with Intune?

Devices must be Azure AD joined only
All clients must be upgraded to the latest CCM agent
Configuration Manager must be hosted in Azure
Configuration Manager must be version 1902 or later (Correct answer)

Correct answer: Configuration Manager must be version 1902 or later

Co-management requires Configuration Manager version 1902 or later (or current branch) to support the integration with Microsoft Intune.

Question 34: Which Azure AD (Entra ID) feature allows an administrator to immediately revoke all active sessions across devices when a security incident is detected?

Revoke user sign-in sessions action (Correct answer)
Identity protection Risky sign-in policy
Azure AD Password Protection
Conditional access Sign-in frequency policy

Correct answer: Revoke user sign-in sessions action

The Revoke sessions action in Azure AD immediately invalidates all refresh tokens and active sessions for a user, forcing re-authentication on all devices and apps.

Question 35: An administrator needs to check which Windows updates are installed on a specific managed device from the Intune portal. Where should they look?

Devices > Monitor > Windows Update > Feature update failures
Reports > Endpoint analytics > Device performance
Devices > Select device > Monitor > Windows update installations (Correct answer)
Devices > Device compliance

Correct answer: Devices > Select device > Monitor > Windows update installations

In Intune, navigating to a specific device and selecting Monitor then Windows update installations shows the update history for that device, including installed updates and any failures.

Question 36: A company wants to enforce multi-factor authentication for all admin sign-ins to Azure AD. What is the simplest way to enforce this for all global administrators?

Per-user MFA
Conditional Access policy
Identity Protection policy
Security defaults (Correct answer)

Correct answer: Security defaults

Security defaults in Azure AD automatically require MFA for all administrators and provide baseline identity protection with minimal configuration.

Question 37: In Microsoft Intune, which profile type is used to configure Wi-Fi settings and push them to managed Windows devices?

Compliance policy
Endpoint protection profile
Device configuration profile (Correct answer)
Update ring

Correct answer: Device configuration profile

Device configuration profiles in Intune are used to push settings such as Wi-Fi networks, VPN connections, email, and certificates to managed devices.

Question 38: Which license is required to use Azure AD Privileged Identity Management (PIM)?

Azure AD Premium P1
Microsoft 365 Business Basic
Azure AD Premium P2 (Correct answer)
Azure AD Free

Correct answer: Azure AD Premium P2

Azure AD Privileged Identity Management requires Azure AD Premium P2 licenses to provide just-in-time privileged access management.

Question 39: What is the recommended maximum deferral period for quality (security) updates in Windows Update for Business?

90 days
60 days
30 days (Correct answer)
7 days

Correct answer: 30 days

Microsoft recommends deferring quality updates by no more than 30 days to ensure devices receive critical security patches in a timely manner while still allowing validation time.

Question 40: What is the purpose of the 'Delivery Optimization' setting in Windows update management?

Prioritizes update installation during business hours
Reduces bandwidth by allowing devices to share update content with each other (Correct answer)
Encrypts update packages before download
Schedules updates based on device usage patterns

Correct answer: Reduces bandwidth by allowing devices to share update content with each other

Delivery Optimization uses peer-to-peer and cache server technology to reduce internet bandwidth by allowing devices to share downloaded update content within the network.

Question 41: You have an Azure AD tenant named contoso.com. You plan to purchase 25 computers that run Windows 11. You plan to deliver the computers directly to users. You need to ensure that during the out-of-box experience (OBE), users are prompted to sign in, and then the computers are configured to use Microsoft Intune. Which two components should you configure?

a Windows Autopilot deployment profile for self-deploying mode
automatic enrollment (Correct answer)
an unattend.xml answer file
a provisioning package
a Windows Autopilot deployment profile for user-driven mode (Correct answer)

Correct answer: automatic enrollment

To ensure users are prompted to sign in during the Out-of-Box Experience (OOBE) and devices are configured with Intune, two key components are needed. First, automatic enrollment must be configured in Azure AD/Intune so that when a user signs in with corporate credentials, the device automatically enrolls. Second, a Windows Autopilot deployment profile for user-driven mode is essential, as this profile guides the OOBE, prompts for credentials, and applies Intune configurations.

Question 42: What is Windows Information Protection (WIP) designed to do?

Enforce password policies on Windows devices
Separate and protect corporate data from personal data on Windows devices without requiring full MDM enrollment (Correct answer)
Encrypt hard drives using BitLocker across the enterprise
Block access to corporate data when a device is non-compliant

Correct answer: Separate and protect corporate data from personal data on Windows devices without requiring full MDM enrollment

Windows Information Protection (WIP) provides data separation on Windows devices, tagging corporate data and restricting how it can be shared or copied to non-corporate apps, without requiring full MDM enrollment.

Question 43: Which Intune enrollment type is used for company-owned iOS devices that need to be enrolled without user interaction using Apple's DEP/ADE?

BYOD enrollment
Apple Configurator enrollment
User enrollment
Automated Device Enrollment (ADE) (Correct answer)

Correct answer: Automated Device Enrollment (ADE)

Automated Device Enrollment (formerly DEP) allows organizations to automatically enroll corporate-owned iOS devices into Intune without user interaction through Apple Business Manager.

Question 44: Which Windows ADK component is required for creating bootable WinPE media used during OS deployment?

Application Compatibility Toolkit
Windows Performance Toolkit
Windows Preinstallation Environment (WinPE) add-on (Correct answer)
User State Migration Tool (USMT)

Correct answer: Windows Preinstallation Environment (WinPE) add-on

The Windows PE add-on for the Windows ADK provides the tools needed to create bootable WinPE media used during OS deployment tasks.

Question 45: A company wants to keep 50 devices on Windows 10 21H2 indefinitely while the rest upgrade. Which Long-Term Servicing Channel version supports this scenario for non-specialized devices?

Windows 10 Enterprise LTSB
Windows 11 LTSC 2024
Windows 10 LTSC 2019
Windows 10 LTSC 2021 (Correct answer)

Correct answer: Windows 10 LTSC 2021

Windows 10 LTSC 2021 is the appropriate Long-Term Servicing Channel release for devices that require a stable, unchanging OS version, with 5 years of mainstream support.

Question 46: You have a Microsoft 365 subscription that includes Microsoft Intune. The subscription contains corporate-owned, fully managed Android Enterprise devices. You plan to deploy a configuration profile that will have a device restrictions profile type named Profile1. Profile1 will assign maintenance windows for system updates. What should you configure from the Configuration settings for Profile1?

Device experience (Correct answer)
Power Settings Explanation
Connectivity
General

Correct answer: Device experience

Question 47: What is the purpose of running Sysprep /generalize before capturing a Windows image?

It installs the latest Windows updates on the reference device
It compresses the Windows image to save disk space
It removes machine-specific information so the image can be deployed to multiple devices (Correct answer)
It enables BitLocker on the reference device

Correct answer: It removes machine-specific information so the image can be deployed to multiple devices

Sysprep /generalize removes machine-specific data such as the SID and hardware identifiers, allowing the same image to be deployed to many different devices, each receiving a unique identity.

Question 48: Which Autopilot setting determines how the device joins Azure AD during deployment?

Enrollment status page setting
User account type
Join type (Correct answer)
Deployment mode

Correct answer: Join type

The Join type setting in an Autopilot deployment profile specifies whether the device performs a standard Azure AD join or a Hybrid Azure AD join that also joins the on-premises Active Directory domain.

Question 49: Which Windows Autopilot deployment mode allows a technician to pre-configure a device before handing it to the end user?

Reset mode
Pre-provisioning (white glove) mode (Correct answer)
User-driven mode
Self-deploying mode

Correct answer: Pre-provisioning (white glove) mode

Pre-provisioning (white glove) mode allows IT staff or partners to complete the Autopilot provisioning process on behalf of the user so the device is fully configured before reaching the end user.

Question 50: Which app deployment type in Intune is used to add a link to a website as an app icon in the Company Portal?

LOB app
Win32 app
Microsoft Store app
Web link (Correct answer)

Correct answer: Web link

The Web link app type in Intune creates a shortcut to a URL that appears in the Company Portal, allowing users to easily launch web applications.

MD-102 Exam

The MD-102 Microsoft Endpoint Administrator exam validates skills in deploying Windows client, managing identity and compliance, managing and protecting devices, and managing applications using Microsoft Intune and related technologies.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds