MD-100: Windows Client — Questions and Answers

Question 1: A Windows 10 device is experiencing intermittent crashes (BSODs). Which tool generates a readable analysis of the memory dump file?

Reliability Monitor
WinDbg (Windows Debugger) (Correct answer)
Event Viewer
Performance Monitor

Correct answer: WinDbg (Windows Debugger)

WinDbg can open and analyze minidump or full dump files to identify the faulting module or driver causing BSODs.

Question 2: Which command extends a simple volume on a dynamic disk using all available unallocated space from the command line?

chkdsk /extend
fsutil extend
format /extend
diskpart > extend (Correct answer)

Correct answer: diskpart > extend

In DiskPart, selecting the volume and running 'extend' expands it into adjacent unallocated space.

Question 3: What is the difference between 'Repair' and 'Reset' options for an installed Windows 10 app in Settings?

Reset fixes the app without losing data; Repair clears data
Repair is only for Store apps; Reset is only for desktop apps
Repair fixes the app without losing data; Reset reinstalls it and clears all app data (Correct answer)
Both options remove and reinstall the app

Correct answer: Repair fixes the app without losing data; Reset reinstalls it and clears all app data

Repair attempts to fix the app while keeping its settings and data intact; Reset restores the app to its original state and deletes data.

Question 4: A drive shows as 'RAW' in Disk Management after a power failure. What is the most likely cause?

The drive is a new unformatted disk
The drive has been encrypted by BitLocker
The file system is corrupted or unrecognized (Correct answer)
The drive requires a driver update

Correct answer: The file system is corrupted or unrecognized

A RAW file system status means Windows cannot recognize or read the file system, usually due to corruption.

Question 5: Which Windows 10 feature runs Microsoft Edge in an isolated Hyper-V container to contain browser-based attacks?

Controlled Folder Access
Windows Defender Application Guard (Correct answer)
Device Guard
Windows Sandbox

Correct answer: Windows Defender Application Guard

Application Guard launches Edge in a hardware-isolated Hyper-V container so malicious websites cannot access the host OS.

Question 6: What does running 'msiexec /x {ProductCode}' accomplish?

Installs an MSI from a network share
Lists all installed MSI packages
Repairs an MSI installation
Silently uninstalls an MSI application using its product GUID (Correct answer)

Correct answer: Silently uninstalls an MSI application using its product GUID

The /x switch with a product GUID tells msiexec to remove (uninstall) the specified application from the system.

Question 7: Where does Windows 10 store application compatibility settings when a user manually applies them via right-click > Properties > Compatibility?

In Group Policy preferences
In the AppData\Local\Temp folder
In the registry under HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags (Correct answer)
In a .compat file next to the executable

Correct answer: In the registry under HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags

Per-user compatibility settings are stored in the registry path HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers.

Question 8: Which sign-in option uses a short numeric code as an alternative to a password on Windows 10?

Picture Password
PIN (Correct answer)
Security Key
Windows Hello Face

Correct answer: PIN

A PIN is a short numeric (or alphanumeric) code that Windows Hello uses as a convenient sign-in alternative tied to the device.

Question 9: Which Windows 10 command shows a list of all currently installed applications using PowerShell?

Get-AppxPackage (Correct answer)
Get-InstalledApp
winget list
Get-Package -ProviderName msi

Correct answer: Get-AppxPackage

Get-AppxPackage lists all installed UWP/Store apps for the current user or all users when the -AllUsers flag is added.

Question 10: Intune-enrolled Windows 10 laptop. Device configuration and compliance policies use the same setting. Which setting wins?

Most restrictive setting wins
Less restrictive setting wins
Device Configuration Policy setting wins
Device Compliance Policy setting wins (Correct answer)

Correct answer: Device Compliance Policy setting wins

When there's a conflict between a device configuration policy and a device compliance policy for the same setting on an Intune-enrolled device, the device compliance policy typically takes precedence. Compliance policies are designed to enforce critical security and organizational standards, ensuring that devices meet specific requirements before gaining access to resources.

Question 11: Which protocol accesses emails from any device?

TCP
IMAP (Correct answer)
POP
PGP

Correct answer: IMAP

IMAP (Internet Message Access Protocol) allows users to access and manage emails directly on the mail server. This means emails are stored on the server, and changes made on one device (like reading, deleting, or moving an email) are synchronized across all devices accessing that mailbox, making it ideal for accessing emails from multiple locations.

Question 12: Which offering has Intune?

Microsoft Managed Desktop
Windows Autopilot
Microsoft Visual Studio
Microsoft Enterprise Mobility + Security (Correct answer)

Correct answer: Microsoft Enterprise Mobility + Security

Microsoft Intune is a key component of Microsoft Enterprise Mobility + Security (EMS), a suite of products designed to help organizations manage and secure their mobile devices, apps, and data. EMS provides a comprehensive set of identity, access, data protection, and device management capabilities, with Intune handling the mobile device and application management aspects.

Question 13: Which Windows 10 Pro feature allows administrators to control which applications users are allowed to run using publisher, path, or hash rules?

Windows Defender Application Guard
AppLocker (Correct answer)
Controlled Folder Access
Software Restriction Policies

Correct answer: AppLocker

AppLocker lets administrators define rules that allow or deny execution of applications based on file attributes.

Question 14: Which Windows 10 compatibility feature allows you to run an application as if it were on an older version of Windows?

WOW64
Compatibility Mode (Correct answer)
Application Guard
Windows Sandbox

Correct answer: Compatibility Mode

Compatibility Mode sets registry flags that make the application believe it is running on an older OS version like Windows XP or 7.

Question 15: Which Windows 10 feature allows you to run and test untrusted applications in an isolated, disposable environment?

Application Guard
AppLocker
Hyper-V
Windows Sandbox (Correct answer)

Correct answer: Windows Sandbox

Windows Sandbox provides a lightweight, isolated desktop environment that is destroyed when closed, leaving the host system unaffected.

Question 16: The Recycle Bin deletes files immediately.

True
False (Correct answer)

Correct answer: False

The Recycle Bin acts as a temporary storage area for deleted files and folders in Windows. Files moved to the Recycle Bin are not immediately deleted from the system; they remain there until the user manually empties the Recycle Bin or a certain storage limit is reached. This allows for recovery of accidentally deleted items.

Question 17: What is the purpose of Windows Defender SmartScreen?

Monitors network packets for intrusions
Warns users about or blocks unrecognized apps and malicious websites (Correct answer)
Encrypts web traffic
Scans emails for phishing links

Correct answer: Warns users about or blocks unrecognized apps and malicious websites

SmartScreen checks downloaded files and websites against a cloud-based reputation database and warns users about suspicious content.

Question 18: Which Windows 10 feature provides full-disk encryption to protect data on laptops if they are lost or stolen?

Windows Defender
EFS (Encrypting File System)
Secure Boot
BitLocker Drive Encryption (Correct answer)

Correct answer: BitLocker Drive Encryption

BitLocker encrypts entire volumes to protect data at rest, requiring a PIN, USB key, or TPM for pre-boot authentication.

Question 19: Which Windows 10 feature displays an application and system reliability history as a graphical timeline?

Reliability Monitor (Correct answer)
Performance Monitor
Event Viewer
Task Manager

Correct answer: Reliability Monitor

Reliability Monitor shows a daily stability index graph and lists application crashes, Windows failures, and warnings over time.

Question 20: What happens to a local user profile when a local account is deleted in Windows 10?

The profile folder remains unless explicitly deleted (Correct answer)
The profile is automatically deleted
The profile is transferred to the guest account
The profile is archived to a ZIP file

Correct answer: The profile folder remains unless explicitly deleted

Deleting a local account removes the account but leaves the profile folder in C:\Users unless you choose to delete it.

Question 21: Which Windows Hello authentication method uses facial recognition to sign in to Windows 10?

Windows Hello Face (Correct answer)
Windows Hello Fingerprint
Windows Hello PIN
Windows Hello FIDO2

Correct answer: Windows Hello Face

Windows Hello Face uses an IR camera to perform biometric facial recognition for passwordless sign-in.

Question 22: What does enabling 'Exploit protection' in Windows Security help prevent?

Memory-based exploits such as buffer overflows and heap spraying (Correct answer)
Unauthorized user account creation
Malicious email attachments
Network intrusions from the internet

Correct answer: Memory-based exploits such as buffer overflows and heap spraying

Exploit protection applies DEP, ASLR, CFG, and other memory protections to processes to block common exploit techniques.

Question 23: Windows' main workspace is called .

shortcut
folder
taskbar
desktop (Correct answer)

Correct answer: desktop

The desktop is the primary graphical user interface (GUI) of Windows, serving as the main workspace where users can access programs, files, and folders. It displays icons, shortcuts, and the taskbar, providing the central point for user interaction with the operating system.

Question 24: A Windows 10 PC is running slowly. Which built-in tool analyzes startup services and provides a performance score?

Windows Experience Index
Performance Monitor (perfmon)
Task Manager > Performance and Startup tabs (Correct answer)
Resource Monitor

Correct answer: Task Manager > Performance and Startup tabs

Task Manager's Performance tab shows real-time CPU, memory, and disk utilization, while the Startup tab rates each item's impact.

Question 25: Which Windows 10 feature restricts which applications can modify files in protected folders, defending against ransomware?

Windows Firewall
Windows Sandbox
AppLocker
Controlled Folder Access (Correct answer)

Correct answer: Controlled Folder Access

Controlled Folder Access is part of Windows Defender Exploit Guard and blocks unauthorized apps from changing files in protected folders.

Question 26: Which Windows 10 feature creates periodic snapshots of system files and registry settings that can be used to roll back unwanted changes?

System Restore (Correct answer)
Storage Spaces
File History
Backup and Restore (Windows 7)

Correct answer: System Restore

System Restore saves restore points containing system file and registry snapshots, allowing rollback of driver, update, or software changes without affecting personal files.

Question 27: Which tool should a technician use to uninstall a stubborn application that doesn't appear in 'Apps & features'?

Task Manager
Programs and Features in Control Panel or a third-party uninstaller (Correct answer)
Device Manager
Disk Cleanup

Correct answer: Programs and Features in Control Panel or a third-party uninstaller

Control Panel's Programs and Features often lists legacy apps not shown in Settings, and third-party tools can force-remove entries.

Question 28: A user wants to automatically back up files in their Documents, Pictures, and Videos folders. Which built-in Windows 10 feature should they configure?

File History (Correct answer)
System Restore
Backup and Restore (Windows 7)
OneDrive only

Correct answer: File History

File History continuously backs up files in designated libraries and folders to a connected drive or network location.

Question 29: What does the 'Previous Versions' feature in Windows 10 rely on to restore earlier copies of files?

Backup and Restore (Windows 7)
File History
Shadow Copies (Volume Shadow Copy Service) (Correct answer)
OneDrive versioning

Correct answer: Shadow Copies (Volume Shadow Copy Service)

Previous Versions are created by the Volume Shadow Copy Service (VSS), which takes point-in-time snapshots of volumes.

Question 30: What is the primary purpose of Windows Defender Credential Guard?

Blocks brute-force login attempts
Isolates credential hashes and tokens in a virtualized container to prevent pass-the-hash attacks (Correct answer)
Stores passwords in a local encrypted vault
Encrypts the SAM database

Correct answer: Isolates credential hashes and tokens in a virtualized container to prevent pass-the-hash attacks

Credential Guard uses virtualization-based security to protect NTLM hashes and Kerberos tickets from theft.

Question 31: Which Sysinternals or built-in Windows tool shows which process has a file or folder locked, preventing deletion?

Task Manager (basic)
Event Viewer
File Explorer
Process Explorer or Resource Monitor (Correct answer)

Correct answer: Process Explorer or Resource Monitor

Process Explorer (Sysinternals) and Resource Monitor's CPU tab can identify the process holding a file handle lock.

Question 32: Which Windows 10 tool can be used to schedule automated maintenance tasks like disk cleanup or backups?

Services.msc
Task Scheduler (taskschd.msc) (Correct answer)
Event Viewer
System Configuration

Correct answer: Task Scheduler (taskschd.msc)

Task Scheduler allows creation of automated tasks triggered by time, events, or system conditions for any program or script.

Question 33: What is the purpose of the Windows Program Compatibility Troubleshooter?

Uninstalls incompatible applications
Automatically detects and recommends compatibility settings for applications that don't run correctly (Correct answer)
Moves apps to a compatible OS partition
Updates application drivers

Correct answer: Automatically detects and recommends compatibility settings for applications that don't run correctly

The Program Compatibility Troubleshooter tests different compatibility modes and settings to identify what makes an older app work on Windows 10.

Question 34: Which Windows 10 utility defragments HDDs and optimizes (TRIM) SSDs on a schedule?

Storage Sense
Optimize Drives (defrag) (Correct answer)
chkdsk
Disk Cleanup

Correct answer: Optimize Drives (defrag)

Optimize Drives automatically detects drive type, running defragmentation for HDDs and TRIM/retrim operations for SSDs.

Question 35: What hardware component stores the BitLocker encryption keys and measures boot integrity on modern Windows 10 devices?

Secure Enclave
TPM (Trusted Platform Module) (Correct answer)
System BIOS
UEFI Firmware

Correct answer: TPM (Trusted Platform Module)

The TPM chip securely stores BitLocker keys and validates the boot environment to detect tampering.

Question 36: Which Windows 10 recovery option completely wipes the drive and reinstalls Windows from the cloud, removing all manufacturer bloatware?

Reset this PC > Keep my files
Windows Recovery Environment > Startup Repair
Cloud Download reset option in 'Reset this PC'
Fresh Start (now called Reset this PC > Cloud download) (Correct answer)

Correct answer: Fresh Start (now called Reset this PC > Cloud download)

The Cloud download option in Reset this PC downloads a fresh Windows 10 image directly from Microsoft, bypassing the local recovery partition.

Question 37: Which Windows 10 tool provides a graphical view of disk partitions and allows you to shrink, extend, or format volumes?

DiskPart
File Explorer
Disk Management (Correct answer)
Storage Spaces

Correct answer: Disk Management

Disk Management (diskmgmt.msc) provides a GUI for partitioning disks, creating volumes, and assigning drive letters.

Question 38: Which Windows Defender feature monitors processes in real time and blocks known malicious code from executing?

Exploit protection
Cloud-delivered protection
Real-time protection (Correct answer)
Controlled folder access

Correct answer: Real-time protection

Real-time protection continuously scans files, programs, and processes as they run, blocking known malware immediately.

Question 39: Which Windows 10 feature allows you to combine multiple physical disks into a single logical storage pool with redundancy options?

Storage Spaces (Correct answer)
Dynamic Disks
RAID in BIOS
Disk Management

Correct answer: Storage Spaces

Storage Spaces lets you pool physical drives and create virtual disks with mirroring or parity for resilience.

Question 40: You are the Microsoft Endpoint Manager administrator at Techuisitve. You administer Windows 10 devices enrolled with Microsoft Intune. The company has a large number of Windows 10 professional devices. All devices running Windows 10 Professional must be upgraded to Windows 10 Enterprise. What should you do?

Create a device compliance policy
None of these
Create a device configuration profile (Correct answer)
Create a provisioning package

Correct answer: Create a device configuration profile

To upgrade Windows 10 Professional devices to Windows 10 Enterprise using Microsoft Intune, you would create a device configuration profile. This profile type allows you to deploy an 'Edition upgrade' policy, which uses a product key or a subscription activation to perform the upgrade across multiple devices efficiently and at scale.

Question 41: From a running Windows 10 system, which navigation path launches Advanced Startup to boot into the Windows Recovery Environment?

Settings > Update & Security > Recovery > Advanced startup > Restart now (Correct answer)
Control Panel > System > Advanced system settings > Recovery
System Configuration (msconfig) > Boot > Safe boot
Task Manager > Startup > Advanced Options

Correct answer: Settings > Update & Security > Recovery > Advanced startup > Restart now

Settings > Update & Security > Recovery > Advanced startup > Restart now reboots the PC into WinRE where recovery tools are available.

Question 42: Which Windows 10 tool allows you to see all startup programs and disable those that slow down boot time?

Services.msc
msconfig > Boot tab
Task Manager > Startup tab (Correct answer)
Autoruns from Sysinternals

Correct answer: Task Manager > Startup tab

The Startup tab in Task Manager lists applications configured to launch at logon and shows their startup impact.

Question 43: What type of attack does the Account Lockout Policy primarily protect against?

Phishing attacks
Brute-force password attacks (Correct answer)
Replay attacks
Man-in-the-middle attacks

Correct answer: Brute-force password attacks

Account lockout limits consecutive failed attempts, making automated brute-force guessing of passwords impractical.

Question 44: A user receives a UAC prompt when trying to install an application. What is the purpose of User Account Control (UAC)?

To enforce BitLocker before installs
To prevent unauthorized changes to the OS by requiring elevation approval for administrative actions (Correct answer)
To log user activity to Event Viewer
To block all installations by non-admin users

Correct answer: To prevent unauthorized changes to the OS by requiring elevation approval for administrative actions

UAC prompts users to confirm or provide admin credentials before allowing operations that could affect system integrity.

Question 45: What is a 'recovery key' in the context of BitLocker?

A USB drive with the OS installer
An administrator password reset token
A 48-digit numerical key used to unlock a BitLocker-encrypted drive when normal authentication fails (Correct answer)
A backup of the TPM chip data

Correct answer: A 48-digit numerical key used to unlock a BitLocker-encrypted drive when normal authentication fails

The BitLocker recovery key is a 48-digit code generated during encryption setup that unlocks the drive if the TPM or PIN fails.

Question 46: Which command-line utility can be used to check and repair file system errors on a Windows volume?

defrag
sfc
diskpart
chkdsk (Correct answer)

Correct answer: chkdsk

The 'chkdsk' command scans a volume for file system errors and bad sectors, and can repair them with the /f switch.

Question 47: Which Performance Monitor feature lets you schedule data collection over a period of time and save results for later analysis?

Reliability Monitor traces
Event Subscriptions
Data Collector Sets (Correct answer)
Task Scheduler jobs

Correct answer: Data Collector Sets

Data Collector Sets in Performance Monitor group counters and traces into scheduled collection jobs that log results to files for trend analysis.

Question 48: Ten-Gigabit Ethernet was developed by an IEEE committee and designated as a standard?

802.5
802.3
802.11
802.3ae (Correct answer)

Correct answer: 802.3ae

The IEEE 802.3ae standard specifically defines Ten-Gigabit Ethernet, which is an extension of the Ethernet standard for operating at 10 gigabits per second. This standard was developed by the IEEE 802.3 working group to meet the increasing bandwidth demands in data centers and enterprise networks.

Question 49: A deployed Windows 10 app keeps crashing. Which Event Viewer log primarily records application crashes and errors?

Windows Logs > Application (Correct answer)
Windows Logs > Security
Applications and Services Logs > Microsoft > Windows > AppLocker
Windows Logs > System

Correct answer: Windows Logs > Application

The Application log in Windows Logs records events from user-mode applications including crashes, errors, and warnings.

Question 50: A user wants to move a 10 GB file to a USB drive formatted as FAT32. What will happen?

The transfer will succeed normally
The file will be split into 4 GB chunks
The file will be compressed automatically
The operation will fail because FAT32 has a 4 GB per-file size limit (Correct answer)

Correct answer: The operation will fail because FAT32 has a 4 GB per-file size limit

FAT32 has a maximum single file size of 4 GB minus 1 byte, so a 10 GB file cannot be stored on it.

MD-100: Windows Client

MD-100 validates IT professionals' expertise in installing, configuring, and maintaining Windows clients within a domain infrastructure. It covers Windows deployment, connectivity, storage, maintenance, and security/data protection in Microsoft Entra environments.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Eligibility, renewal, score validity, passing score, score release, exam format, exam information · verified Nov 2026
home.pearsonvue.com — Test delivery · verified Oct 2026