MD-100: Windows Client — Questions and Answers

Question 1: Which command-line tool can be used to install, update, and remove Windows applications as a package manager?

msiexec
winget (Correct answer)
choco
powershell install-package

Correct answer: winget

Winget is Microsoft's official Windows Package Manager CLI tool for discovering and managing application installations.

Question 2: Which Windows 10 feature provides full-disk encryption to protect data on laptops if they are lost or stolen?

Windows Defender
BitLocker Drive Encryption (Correct answer)
EFS (Encrypting File System)
Secure Boot

Correct answer: BitLocker Drive Encryption

BitLocker encrypts entire volumes to protect data at rest, requiring a PIN, USB key, or TPM for pre-boot authentication.

Question 3: A user double-clicks a .pdf file and the wrong application opens. Where can the default app association be changed in Windows 10?

Either A or C (Correct answer)
Right-click > Properties > Change > (in File Explorer)
Control Panel > Programs > Set program access
Settings > Apps > Default apps > Choose default apps by file type

Correct answer: Either A or C

Default apps by file type can be set in Settings > Apps > Default apps, or on a per-file basis by right-clicking and choosing Open with > Choose another app.

Question 4: What type of attack does the Account Lockout Policy primarily protect against?

Phishing attacks
Replay attacks
Man-in-the-middle attacks
Brute-force password attacks (Correct answer)

Correct answer: Brute-force password attacks

Account lockout limits consecutive failed attempts, making automated brute-force guessing of passwords impractical.

Question 5: Which tool should a technician use to uninstall a stubborn application that doesn't appear in 'Apps & features'?

Programs and Features in Control Panel or a third-party uninstaller (Correct answer)
Device Manager
Disk Cleanup
Task Manager

Correct answer: Programs and Features in Control Panel or a third-party uninstaller

Control Panel's Programs and Features often lists legacy apps not shown in Settings, and third-party tools can force-remove entries.

Question 6: What type of partition style supports drives larger than 2 TB and is required for UEFI boot disks?

Primary Partition
Dynamic Disk
MBR (Master Boot Record)
GPT (GUID Partition Table) (Correct answer)

Correct answer: GPT (GUID Partition Table)

GPT supports drives larger than 2 TB, allows up to 128 partitions, and is required for UEFI-based boot configurations.

Question 7: Which file system is best suited for a USB drive that must be compatible with both Windows and macOS while supporting files larger than 4 GB?

ReFS
NTFS
exFAT (Correct answer)
FAT32

Correct answer: exFAT

exFAT removes FAT32's 4 GB file size limit and is natively supported by both Windows and macOS without third-party drivers.

Question 8: A deployed Windows 10 app keeps crashing. Which Event Viewer log primarily records application crashes and errors?

Applications and Services Logs > Microsoft > Windows > AppLocker
Windows Logs > Application (Correct answer)
Windows Logs > Security
Windows Logs > System

Correct answer: Windows Logs > Application

The Application log in Windows Logs records events from user-mode applications including crashes, errors, and warnings.

Question 9: Some of your desktop windows may be hidden behind others.<br> Which hidden window is easiest to switch to?

Press Ctrl+Alt+ Delete on your keyboard
Click the icon on the taskbar (Correct answer)
Close all programs and reopen them one-by-one
Press your computer's Power button

Correct answer: Click the icon on the taskbar

The taskbar in Windows displays icons for all open applications and windows, even those minimized or hidden behind others. Clicking an application's icon on the taskbar is the quickest and most direct way to bring that specific window to the foreground and make it active, allowing for easy switching between tasks.

Question 10: Which sign-in option uses a short numeric code as an alternative to a password on Windows 10?

Picture Password
Security Key
PIN (Correct answer)
Windows Hello Face

Correct answer: PIN

A PIN is a short numeric (or alphanumeric) code that Windows Hello uses as a convenient sign-in alternative tied to the device.

Question 11: Which Windows 10 recovery option completely wipes the drive and reinstalls Windows from the cloud, removing all manufacturer bloatware?

Fresh Start (now called Reset this PC > Cloud download) (Correct answer)
Reset this PC > Keep my files
Windows Recovery Environment > Startup Repair
Cloud Download reset option in 'Reset this PC'

Correct answer: Fresh Start (now called Reset this PC > Cloud download)

The Cloud download option in Reset this PC downloads a fresh Windows 10 image directly from Microsoft, bypassing the local recovery partition.

Question 12: HSPA employs the HSDPA protocol, which supports a maximum theoretical data rate between?

1.2 Mbps and 16.4 Mbps
1.8 Mbps and 14.4 Mbps (Correct answer)
None of the above
1.4 Mbps and 12.2 Mbps

Correct answer: 1.8 Mbps and 14.4 Mbps

HSPA (High-Speed Packet Access) is a 3G mobile telephony protocol that significantly enhances data transfer speeds. Specifically, HSDPA (High-Speed Downlink Packet Access), a key component of HSPA, theoretically supports downlink data rates ranging from 1.8 Mbps up to 14.4 Mbps, depending on the specific network implementation and channel conditions.

Question 13: A user needs to install a legacy 32-bit application on Windows 10 x64. Is this supported?

Only via a virtual machine
Only if compatibility mode is enabled
No, 64-bit Windows cannot run 32-bit apps
Yes, Windows 10 x64 includes a WOW64 compatibility layer that runs 32-bit applications (Correct answer)

Correct answer: Yes, Windows 10 x64 includes a WOW64 compatibility layer that runs 32-bit applications

WOW64 (Windows 32-bit on Windows 64-bit) is a built-in subsystem that allows 32-bit applications to run transparently on 64-bit Windows.

Question 14: Which Windows 10 feature displays an application and system reliability history as a graphical timeline?

Task Manager
Event Viewer
Performance Monitor
Reliability Monitor (Correct answer)

Correct answer: Reliability Monitor

Reliability Monitor shows a daily stability index graph and lists application crashes, Windows failures, and warnings over time.

Question 15: Which Windows 10 feature allows you to run and test untrusted applications in an isolated, disposable environment?

Hyper-V
Windows Sandbox (Correct answer)
Application Guard
AppLocker

Correct answer: Windows Sandbox

Windows Sandbox provides a lightweight, isolated desktop environment that is destroyed when closed, leaving the host system unaffected.

Question 16: A drive shows as 'RAW' in Disk Management after a power failure. What is the most likely cause?

The drive requires a driver update
The file system is corrupted or unrecognized (Correct answer)
The drive is a new unformatted disk
The drive has been encrypted by BitLocker

Correct answer: The file system is corrupted or unrecognized

A RAW file system status means Windows cannot recognize or read the file system, usually due to corruption.

Question 17: What is the Microsoft Store used for in Windows 10?

Downloading and installing UWP (Universal Windows Platform) apps in a sandboxed, managed way (Correct answer)
Accessing enterprise line-of-business apps
Installing only Microsoft Office products
Downloading driver updates

Correct answer: Downloading and installing UWP (Universal Windows Platform) apps in a sandboxed, managed way

The Microsoft Store distributes UWP apps that are sandboxed, automatically updated, and can be deployed across Windows devices.

Question 18: Which NTFS permission allows a user to list files in a folder but not read file contents?

List Folder Contents (Correct answer)
Read
Read & Execute
Traverse Folder

Correct answer: List Folder Contents

The 'List Folder Contents' permission lets users see file and subfolder names without granting access to read the actual file data.

Question 19: A user receives a UAC prompt when trying to install an application. What is the purpose of User Account Control (UAC)?

To log user activity to Event Viewer
To prevent unauthorized changes to the OS by requiring elevation approval for administrative actions (Correct answer)
To block all installations by non-admin users
To enforce BitLocker before installs

Correct answer: To prevent unauthorized changes to the OS by requiring elevation approval for administrative actions

UAC prompts users to confirm or provide admin credentials before allowing operations that could affect system integrity.

Question 20: What happens to a local user profile when a local account is deleted in Windows 10?

The profile is archived to a ZIP file
The profile folder remains unless explicitly deleted (Correct answer)
The profile is transferred to the guest account
The profile is automatically deleted

Correct answer: The profile folder remains unless explicitly deleted

Deleting a local account removes the account but leaves the profile folder in C:\Users unless you choose to delete it.

Question 21: Which Windows 10 feature creates periodic snapshots of system files and registry settings that can be used to roll back unwanted changes?

System Restore (Correct answer)
File History
Backup and Restore (Windows 7)
Storage Spaces

Correct answer: System Restore

System Restore saves restore points containing system file and registry snapshots, allowing rollback of driver, update, or software changes without affecting personal files.

Question 22: Which Windows Hello authentication method uses facial recognition to sign in to Windows 10?

Windows Hello FIDO2
Windows Hello Fingerprint
Windows Hello PIN
Windows Hello Face (Correct answer)

Correct answer: Windows Hello Face

Windows Hello Face uses an IR camera to perform biometric facial recognition for passwordless sign-in.

Question 23: Which Windows 10 tool provides real-time graphs of CPU, memory, disk, and network performance with per-process drill-down?

Performance Monitor
Task Manager
Process Explorer
Resource Monitor (resmon.exe) (Correct answer)

Correct answer: Resource Monitor (resmon.exe)

Resource Monitor provides detailed real-time views of resource usage including which processes are consuming each resource.

Question 24: Which command extends a simple volume on a dynamic disk using all available unallocated space from the command line?

diskpart > extend (Correct answer)
fsutil extend
chkdsk /extend
format /extend

Correct answer: diskpart > extend

In DiskPart, selecting the volume and running 'extend' expands it into adjacent unallocated space.

Question 25: What is the purpose of Windows Defender SmartScreen?

Monitors network packets for intrusions
Encrypts web traffic
Scans emails for phishing links
Warns users about or blocks unrecognized apps and malicious websites (Correct answer)

Correct answer: Warns users about or blocks unrecognized apps and malicious websites

SmartScreen checks downloaded files and websites against a cloud-based reputation database and warns users about suspicious content.

Question 26: Which Windows 10 feature helps prevent data loss by enabling IT to control whether apps can copy corporate data to personal storage locations?

AppLocker
Windows Information Protection (WIP) (Correct answer)
BitLocker
Controlled Folder Access

Correct answer: Windows Information Protection (WIP)

WIP (formerly EDP) classifies corporate vs. personal data and enforces policies to prevent leakage between the two.

Question 27: Where does Windows 10 store application compatibility settings when a user manually applies them via right-click > Properties > Compatibility?

In a .compat file next to the executable
In Group Policy preferences
In the AppData\Local\Temp folder
In the registry under HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags (Correct answer)

Correct answer: In the registry under HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags

Per-user compatibility settings are stored in the registry path HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers.

Question 28: A user's Windows 10 PC must comply with a policy requiring the screen to lock after 5 minutes of inactivity. Where is this configured?

Control Panel > Mouse
Settings > Ease of Access > Display
Settings > Privacy > Screen timeout
Settings > Personalization > Lock screen > Screen saver settings (Correct answer)

Correct answer: Settings > Personalization > Lock screen > Screen saver settings

The screen saver settings include a 'On resume, display logon screen' option tied to a wait time that enforces screen lock.

Question 29: Where in Windows Security can you view the history of threats detected and remediated by Windows Defender?

App & browser control > Reputation-based protection
Device security > Core isolation
Account protection
Virus & threat protection > Protection history (Correct answer)

Correct answer: Virus & threat protection > Protection history

Protection history in the Virus & threat protection section shows a log of all detected threats and the actions taken.

Question 30: A user forgets their local Windows account password. As an administrator, which command lets you reset it from an elevated prompt?

set password <username>
reset user <username>
passwd <username>
net user <username> <newpassword> (Correct answer)

Correct answer: net user <username> <newpassword>

The 'net user <username> <newpassword>' command resets a local user's password from an elevated command prompt.

Question 31: The Recycle Bin deletes files immediately.

True
False (Correct answer)

Correct answer: False

The Recycle Bin acts as a temporary storage area for deleted files and folders in Windows. Files moved to the Recycle Bin are not immediately deleted from the system; they remain there until the user manually empties the Recycle Bin or a certain storage limit is reached. This allows for recovery of accidentally deleted items.

Question 32: A technician needs to deploy an application silently to multiple Windows 10 PCs. Which msiexec switch combination enables a completely silent install with no UI?

/i setup.msi /quiet /norestart (Correct answer)
/install setup.msi /silent
/i setup.msi /passive
/i setup.msi /s

Correct answer: /i setup.msi /quiet /norestart

The /quiet switch suppresses all UI and /norestart prevents automatic reboots, making the install fully unattended.

Question 33: Techuisitive Microsoft Endpoint Manager administrator. The company recently installed 5 computers in the common area for employees to check their personal emails or visit unsecure websites. <br> Make sure employees can use Microsoft Edge without signing in. These computers should not allow employees to use other applications. Use which device configuration profile type?

Device Restriction
Endpoint Protection
Administrative Templates
Kiosk (Correct answer)

Correct answer: Kiosk

A Kiosk device configuration profile in Microsoft Intune is specifically designed to lock down a device for a single purpose or a limited set of applications. This profile type allows administrators to configure a device to run only specific applications (like Microsoft Edge) and prevent users from accessing other parts of the operating system, making it ideal for public-use computers.

Question 34: A technician discovers that Windows Firewall is blocking a legitimate application. Which tool quickly creates an inbound rule exception?

Either A or C (Correct answer)
Windows Defender Firewall with Advanced Security (wf.msc)
netsh advfirewall
Windows Security > Firewall & network protection > Allow an app

Correct answer: Either A or C

Both the Windows Security app's 'Allow an app through firewall' and the advanced wf.msc console can create inbound exceptions.

Question 35: An administrator wants to enforce a minimum password length of 8 characters for all local accounts. Which tool should be used?

Task Scheduler
Group Policy Editor only available on domain PCs
Registry Editor
Local Security Policy (secpol.msc) (Correct answer)

Correct answer: Local Security Policy (secpol.msc)

Local Security Policy (secpol.msc) contains the Account Policies section where minimum password length is configured.

Question 36: What is the primary purpose of Windows Defender Credential Guard?

Isolates credential hashes and tokens in a virtualized container to prevent pass-the-hash attacks (Correct answer)
Encrypts the SAM database
Stores passwords in a local encrypted vault
Blocks brute-force login attempts

Correct answer: Isolates credential hashes and tokens in a virtualized container to prevent pass-the-hash attacks

Credential Guard uses virtualization-based security to protect NTLM hashes and Kerberos tickets from theft.

Question 37: Which Windows 10 feature allows you to snap applications to predefined screen zones using keyboard shortcuts?

Snap Assist (Correct answer)
Virtual Desktops
Task View
Timeline

Correct answer: Snap Assist

Snap Assist automatically fills remaining screen space with suggestions when you snap a window to one side of the screen.

Question 38: Which Sysinternals or built-in Windows tool shows which process has a file or folder locked, preventing deletion?

Task Manager (basic)
File Explorer
Process Explorer or Resource Monitor (Correct answer)
Event Viewer

Correct answer: Process Explorer or Resource Monitor

Process Explorer (Sysinternals) and Resource Monitor's CPU tab can identify the process holding a file handle lock.

Question 39: What does running 'msiexec /x {ProductCode}' accomplish?

Silently uninstalls an MSI application using its product GUID (Correct answer)
Lists all installed MSI packages
Installs an MSI from a network share
Repairs an MSI installation

Correct answer: Silently uninstalls an MSI application using its product GUID

The /x switch with a product GUID tells msiexec to remove (uninstall) the specified application from the system.

Question 40: Which Windows 10 Pro feature allows administrators to control which applications users are allowed to run using publisher, path, or hash rules?

Controlled Folder Access
Windows Defender Application Guard
AppLocker (Correct answer)
Software Restriction Policies

Correct answer: AppLocker

AppLocker lets administrators define rules that allow or deny execution of applications based on file attributes.

Question 41: Which Windows Defender feature monitors processes in real time and blocks known malicious code from executing?

Cloud-delivered protection
Controlled folder access
Real-time protection (Correct answer)
Exploit protection

Correct answer: Real-time protection

Real-time protection continuously scans files, programs, and processes as they run, blocking known malware immediately.

Question 42: Which Windows 10 feature runs Microsoft Edge in an isolated Hyper-V container to contain browser-based attacks?

Controlled Folder Access
Windows Sandbox
Windows Defender Application Guard (Correct answer)
Device Guard

Correct answer: Windows Defender Application Guard

Application Guard launches Edge in a hardware-isolated Hyper-V container so malicious websites cannot access the host OS.

Question 43: What is the purpose of the Windows 10 'Reset this PC' feature?

Resets only user account passwords
Restores the system to a System Restore point
Formats the drive and requires a clean OS installation from media
Reinstalls Windows while giving the option to keep or remove personal files (Correct answer)

Correct answer: Reinstalls Windows while giving the option to keep or remove personal files

'Reset this PC' reinstalls Windows 10 and optionally preserves user files, providing a clean OS state without full reformatting.

Question 44: What hardware component stores the BitLocker encryption keys and measures boot integrity on modern Windows 10 devices?

System BIOS
Secure Enclave
UEFI Firmware
TPM (Trusted Platform Module) (Correct answer)

Correct answer: TPM (Trusted Platform Module)

The TPM chip securely stores BitLocker keys and validates the boot environment to detect tampering.

Question 45: Which Windows 10 feature allows you to combine multiple physical disks into a single logical storage pool with redundancy options?

RAID in BIOS
Storage Spaces (Correct answer)
Dynamic Disks
Disk Management

Correct answer: Storage Spaces

Storage Spaces lets you pool physical drives and create virtual disks with mirroring or parity for resilience.

Question 46: What is the primary purpose of running DISM with the /RestoreHealth switch?

Defragment and optimize the system drive
Reset all network adapter settings
Repair the local Windows image using Windows Update as the source (Correct answer)
Revert the system to a previous restore point

Correct answer: Repair the local Windows image using Windows Update as the source

DISM /Online /Cleanup-Image /RestoreHealth contacts Windows Update to download healthy component files and repair the local Windows image store.

Question 47: A user wants to automatically back up files in their Documents, Pictures, and Videos folders. Which built-in Windows 10 feature should they configure?

OneDrive only
Backup and Restore (Windows 7)
System Restore
File History (Correct answer)

Correct answer: File History

File History continuously backs up files in designated libraries and folders to a connected drive or network location.

Question 48: From a running Windows 10 system, which navigation path launches Advanced Startup to boot into the Windows Recovery Environment?

System Configuration (msconfig) > Boot > Safe boot
Settings > Update & Security > Recovery > Advanced startup > Restart now (Correct answer)
Control Panel > System > Advanced system settings > Recovery
Task Manager > Startup > Advanced Options

Correct answer: Settings > Update & Security > Recovery > Advanced startup > Restart now

Settings > Update & Security > Recovery > Advanced startup > Restart now reboots the PC into WinRE where recovery tools are available.

Question 49: Which audit policy should be enabled to track successful and failed logon attempts on a standalone Windows 10 PC?

Audit object access
Audit process tracking
Audit account management
Audit logon events (Correct answer)

Correct answer: Audit logon events

Enabling 'Audit logon events' records successful and failed interactive, network, and service logon attempts in the Security event log.

Question 50: You want to prevent a local account from being used to log in interactively but keep the account active. What should you do?

Disable the account (Correct answer)
Delete the account
Remove the account from all groups
Set an expired password

Correct answer: Disable the account

Disabling an account prevents login while preserving the account and its data for potential future re-enabling.

MD-100: Windows Client

MD-100 validates IT professionals' expertise in installing, configuring, and maintaining Windows clients within a domain infrastructure. It covers Windows deployment, connectivity, storage, maintenance, and security/data protection in Microsoft Entra environments.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Eligibility, renewal, score validity, passing score, score release, exam format, exam information · verified Nov 2026
home.pearsonvue.com — Test delivery · verified Oct 2026