MD-100: Windows Client — Questions and Answers

Question 1: What type of attack does the Account Lockout Policy primarily protect against?

Phishing attacks
Man-in-the-middle attacks
Replay attacks
Brute-force password attacks (Correct answer)

Correct answer: Brute-force password attacks

Account lockout limits consecutive failed attempts, making automated brute-force guessing of passwords impractical.

Question 2: An administrator wants to verify that a Windows 10 device enrolled in Intune has successfully applied all assigned configuration profiles. Where in the Azure portal should they look?

Intune > Apps > App protection policies
Azure AD > Enterprise Applications > Device compliance
Azure AD > Devices > Device settings
Intune > Devices > [Device name] > Device configuration (Correct answer)

Correct answer: Intune > Devices > [Device name] > Device configuration

In Microsoft Intune admin center, navigating to Devices > [specific device] > Device configuration shows the assignment and application status of all configuration profiles for that device.

Question 3: What hardware component stores the BitLocker encryption keys and measures boot integrity on modern Windows 10 devices?

System BIOS
Secure Enclave
TPM (Trusted Platform Module) (Correct answer)
UEFI Firmware

Correct answer: TPM (Trusted Platform Module)

The TPM chip securely stores BitLocker keys and validates the boot environment to detect tampering.

Question 4: What is a System Image backup in Windows 10?

A complete sector-by-sector copy of the system drive including OS, settings, and files (Correct answer)
A virtual machine snapshot stored in Hyper-V
A screenshot archive of all desktop configurations
A compressed archive of only personal user data

Correct answer: A complete sector-by-sector copy of the system drive including OS, settings, and files

A System Image is a complete backup of all data on a drive (OS, applications, settings, and files) that can be used to restore the entire system to the exact state at backup time.

Question 5: Which tool should a technician use to uninstall a stubborn application that doesn't appear in 'Apps & features'?

Programs and Features in Control Panel or a third-party uninstaller (Correct answer)
Device Manager
Task Manager
Disk Cleanup

Correct answer: Programs and Features in Control Panel or a third-party uninstaller

Control Panel's Programs and Features often lists legacy apps not shown in Settings, and third-party tools can force-remove entries.

Question 6: Which command displays the current DNS cache on a Windows 10 machine?

netsh dns show cache
nslookup /cache
ipconfig /displaydns (Correct answer)
ipconfig /flushdns

Correct answer: ipconfig /displaydns

ipconfig /displaydns shows all currently cached DNS entries on the local machine.

Question 7: Where in Windows Security can you view the history of threats detected and remediated by Windows Defender?

App & browser control > Reputation-based protection
Virus & threat protection > Protection history (Correct answer)
Device security > Core isolation
Account protection

Correct answer: Virus & threat protection > Protection history

Protection history in the Virus & threat protection section shows a log of all detected threats and the actions taken.

Question 8: What is a 'recovery key' in the context of BitLocker?

A backup of the TPM chip data
An administrator password reset token
A USB drive with the OS installer
A 48-digit numerical key used to unlock a BitLocker-encrypted drive when normal authentication fails (Correct answer)

Correct answer: A 48-digit numerical key used to unlock a BitLocker-encrypted drive when normal authentication fails

The BitLocker recovery key is a 48-digit code generated during encryption setup that unlocks the drive if the TPM or PIN fails.

Question 9: Which Windows 10 setting automatically deletes temporary files and empties the Recycle Bin on a schedule?

OneDrive Files On-Demand
Disk Cleanup
Storage Sense (Correct answer)
Defragment and Optimize Drives

Correct answer: Storage Sense

Storage Sense automatically frees up space by removing temporary files and optionally clearing the Recycle Bin and Downloads folder.

Question 10: Which Windows 10 feature runs Microsoft Edge in an isolated Hyper-V container to contain browser-based attacks?

Windows Sandbox
Windows Defender Application Guard (Correct answer)
Controlled Folder Access
Device Guard

Correct answer: Windows Defender Application Guard

Application Guard launches Edge in a hardware-isolated Hyper-V container so malicious websites cannot access the host OS.

Question 11: A Windows 10 PC shows a valid IP address but cannot browse the internet. Running 'ping 8.8.8.8' succeeds but 'ping google.com' fails. What is the problem?

The default gateway is unreachable
The firewall is blocking all traffic
The network cable is faulty
DNS resolution is failing (Correct answer)

Correct answer: DNS resolution is failing

Successful ping by IP but failed ping by name confirms DNS resolution is the issue, not connectivity itself.

Question 12: An administrator wants to prevent users on shared Windows 10 kiosk devices from accessing settings or installing apps. Which feature should be configured?

User Account Control
Windows Hello for Business
Assigned Access (Kiosk Mode) (Correct answer)
AppLocker

Correct answer: Assigned Access (Kiosk Mode)

Assigned Access restricts a Windows 10 account to run only one app (single-app kiosk) or a limited set of apps (multi-app kiosk).

Question 13: A technician discovers that Windows Firewall is blocking a legitimate application. Which tool quickly creates an inbound rule exception?

netsh advfirewall
Windows Defender Firewall with Advanced Security (wf.msc)
Windows Security > Firewall & network protection > Allow an app
Either A or C (Correct answer)

Correct answer: Either A or C

Both the Windows Security app's 'Allow an app through firewall' and the advanced wf.msc console can create inbound exceptions.

Question 14: Which command-line tool can be used to install, update, and remove Windows applications as a package manager?

choco
msiexec
winget (Correct answer)
powershell install-package

Correct answer: winget

Winget is Microsoft's official Windows Package Manager CLI tool for discovering and managing application installations.

Question 15: Which Windows 10 deployment method uses a task sequence to apply a WIM image, configure settings, and install applications in a fully automated, zero-touch manner?

Windows Deployment Services (WDS)
Windows Autopilot
Microsoft Deployment Toolkit (MDT)
Microsoft Endpoint Configuration Manager (MECM) (Correct answer)

Correct answer: Microsoft Endpoint Configuration Manager (MECM)

MECM (formerly SCCM) uses task sequences to orchestrate full OS deployment with zero-touch automation, including image application, driver injection, and app installation.

Question 16: Which Windows 10 feature restricts which applications can modify files in protected folders, defending against ransomware?

AppLocker
Windows Sandbox
Windows Firewall
Controlled Folder Access (Correct answer)

Correct answer: Controlled Folder Access

Controlled Folder Access is part of Windows Defender Exploit Guard and blocks unauthorized apps from changing files in protected folders.

Question 17: A user double-clicks a .pdf file and the wrong application opens. Where can the default app association be changed in Windows 10?

Control Panel > Programs > Set program access
Right-click > Properties > Change > (in File Explorer)
Settings > Apps > Default apps > Choose default apps by file type
Either A or C (Correct answer)

Correct answer: Either A or C

Default apps by file type can be set in Settings > Apps > Default apps, or on a per-file basis by right-clicking and choosing Open with > Choose another app.

Question 18: What type of partition style supports drives larger than 2 TB and is required for UEFI boot disks?

Dynamic Disk
Primary Partition
GPT (GUID Partition Table) (Correct answer)
MBR (Master Boot Record)

Correct answer: GPT (GUID Partition Table)

GPT supports drives larger than 2 TB, allows up to 128 partitions, and is required for UEFI-based boot configurations.

Question 19: Which Windows 10 tool provides a graphical view of disk partitions and allows you to shrink, extend, or format volumes?

File Explorer
Storage Spaces
DiskPart
Disk Management (Correct answer)

Correct answer: Disk Management

Disk Management (diskmgmt.msc) provides a GUI for partitioning disks, creating volumes, and assigning drive letters.

Question 20: A user receives a UAC prompt when trying to install an application. What is the purpose of User Account Control (UAC)?

To prevent unauthorized changes to the OS by requiring elevation approval for administrative actions (Correct answer)
To enforce BitLocker before installs
To log user activity to Event Viewer
To block all installations by non-admin users

Correct answer: To prevent unauthorized changes to the OS by requiring elevation approval for administrative actions

UAC prompts users to confirm or provide admin credentials before allowing operations that could affect system integrity.

Question 21: A technician needs to deploy an application silently to multiple Windows 10 PCs. Which msiexec switch combination enables a completely silent install with no UI?

/i setup.msi /quiet /norestart (Correct answer)
/i setup.msi /s
/i setup.msi /passive
/install setup.msi /silent

Correct answer: /i setup.msi /quiet /norestart

The /quiet switch suppresses all UI and /norestart prevents automatic reboots, making the install fully unattended.

Question 22: A Windows 10 device enrolled in Intune needs a compliance policy enforced. Which component on the device communicates compliance status back to Intune?

Windows Update Agent
Windows Management Instrumentation (WMI)
MDM client (dmclient.exe) (Correct answer)
Group Policy Client service

Correct answer: MDM client (dmclient.exe)

The MDM client (dmclient.exe) on Windows 10 communicates device configuration and compliance status to the Intune MDM service using the OMA-DM protocol.

Question 23: A user's account is locked out. Which tool can an administrator use to unlock it on a standalone Windows 10 PC?

Task Manager
Local Users and Groups (lusrmgr.msc) (Correct answer)
Device Manager
Event Viewer

Correct answer: Local Users and Groups (lusrmgr.msc)

In lusrmgr.msc, administrators can open the account properties and uncheck the 'Account is locked out' checkbox.

Question 24: Which Windows 10 diagnostic data level is the MINIMUM required for Microsoft to provide Windows Update for Business recommendations?

Security (off)
Basic (Required) (Correct answer)
Full (Optional)
Enhanced (Optional)

Correct answer: Basic (Required)

At minimum, the Basic (Required) diagnostic data level must be enabled for Windows Update for Business and Update Compliance features to function.

Question 25: A user needs to install a legacy 32-bit application on Windows 10 x64. Is this supported?

Yes, Windows 10 x64 includes a WOW64 compatibility layer that runs 32-bit applications (Correct answer)
Only via a virtual machine
Only if compatibility mode is enabled
No, 64-bit Windows cannot run 32-bit apps

Correct answer: Yes, Windows 10 x64 includes a WOW64 compatibility layer that runs 32-bit applications

WOW64 (Windows 32-bit on Windows 64-bit) is a built-in subsystem that allows 32-bit applications to run transparently on 64-bit Windows.

Question 26: You need to restrict a Windows 10 user from installing software from outside the Microsoft Store. Which Group Policy setting accomplishes this?

Software Restriction Policies – Disallowed (Correct answer)
Only display the private store within the Microsoft Store app
Turn off Autoplay for all drives
Prevent users from installing application extensions

Correct answer: Software Restriction Policies – Disallowed

Software Restriction Policies with a default rule of 'Disallowed' blocks execution of unauthorized software unless explicitly allowed by path, hash, or certificate rules.

Question 27: What happens to a sideloaded UWP app package (.appx) installed outside the Microsoft Store if its developer certificate expires?

Windows Defender quarantines the app
Nothing — installed apps run regardless of certificate status
The app may stop launching unless the certificate is renewed or trust is re-established (Correct answer)
The app is automatically uninstalled

Correct answer: The app may stop launching unless the certificate is renewed or trust is re-established

Sideloaded apps rely on certificate trust; if the signing certificate expires or is revoked, Windows may block app execution.

Question 28: Which tool allows administrators to configure Windows 10 devices using XML-based provisioning packages without MDM enrollment?

Group Policy Management Console
Windows Configuration Designer (Correct answer)
Windows Deployment Services
Microsoft Endpoint Manager

Correct answer: Windows Configuration Designer

Windows Configuration Designer creates provisioning packages (.ppkg files) that can configure Windows 10 devices without requiring MDM enrollment.

Question 29: A technician needs to resize a Windows 10 system volume without data loss. The 'Extend Volume' option in Disk Management is grayed out. What is the most likely reason?

There is no contiguous unallocated space immediately after the volume (Correct answer)
The volume is formatted with FAT32
BitLocker is enabled on the drive
The disk is not initialized

Correct answer: There is no contiguous unallocated space immediately after the volume

Disk Management can only extend a volume using contiguous unallocated space that directly follows the partition; non-contiguous free space makes the option unavailable.

Question 30: Which Windows 10 setting determines whether the PC automatically connects to known Wi-Fi networks when in range?

Connect automatically checkbox in the Wi-Fi network properties (Correct answer)
Airplane mode toggle
Metered connection setting
Network Discovery setting in Advanced Sharing

Correct answer: Connect automatically checkbox in the Wi-Fi network properties

The 'Connect automatically' checkbox in each Wi-Fi network's properties controls whether Windows reconnects to that network when in range.

Question 31: Which Windows 10 command shows a list of all currently installed applications using PowerShell?

winget list
Get-Package -ProviderName msi
Get-AppxPackage (Correct answer)
Get-InstalledApp

Correct answer: Get-AppxPackage

Get-AppxPackage lists all installed UWP/Store apps for the current user or all users when the -AllUsers flag is added.

Question 32: Which Windows 10 built-in tool provides a unified interface for managing local users, groups, disk partitions, services, and device drivers?

Task Manager
Computer Management (Correct answer)
System Information
Resource Monitor

Correct answer: Computer Management

Computer Management (compmgmt.msc) consolidates System Tools, Storage, and Services and Applications into a single MMC snap-in.

Question 33: An organization wants to prevent users from enrolling personal devices into Intune. Which Intune feature restricts enrollment by device type or platform?

Device Category Rules
Device Compliance Policy
Conditional Access Policy
Enrollment Restrictions (Correct answer)

Correct answer: Enrollment Restrictions

Enrollment Restrictions in Intune control which device platforms, OS versions, and personally-owned (BYOD) devices can enroll in MDM.

Question 34: "You are in charge of the Microsoft Intune-enabled Windows 10 devices. You are required to make sure that only authorized locations can access Microsoft Exchange online.<br> What needs to be configured to fulfill the requirement? "

Create a provisioning package
Create a device configuration profile (Correct answer)
None of these
Create a device compliance policy

Correct answer: Create a device configuration profile

To restrict access to Microsoft Exchange Online based on location, you would typically use Conditional Access policies, which are often integrated with or managed through device configuration profiles in Intune. A device configuration profile allows you to deploy specific settings, policies, and restrictions to devices, including network access controls or VPN configurations that could enforce location-based access.

Question 35: A user's Windows 10 PC must comply with a policy requiring the screen to lock after 5 minutes of inactivity. Where is this configured?

Settings > Personalization > Lock screen > Screen saver settings (Correct answer)
Settings > Privacy > Screen timeout
Control Panel > Mouse
Settings > Ease of Access > Display

Correct answer: Settings > Personalization > Lock screen > Screen saver settings

The screen saver settings include a 'On resume, display logon screen' option tied to a wait time that enforces screen lock.

Question 36: Which Windows 10 security feature helps prevent unsigned or untrusted drivers from loading during boot?

BitLocker
Secure Boot (Correct answer)
Windows Defender SmartScreen
Device Guard

Correct answer: Secure Boot

Secure Boot is a UEFI feature that only allows digitally signed bootloaders and OS components to execute at startup.

Question 37: A deployed Windows 10 app keeps crashing. Which Event Viewer log primarily records application crashes and errors?

Windows Logs > Security
Windows Logs > Application (Correct answer)
Applications and Services Logs > Microsoft > Windows > AppLocker
Windows Logs > System

Correct answer: Windows Logs > Application

The Application log in Windows Logs records events from user-mode applications including crashes, errors, and warnings.

Question 38: Which file system is best suited for a USB drive that must be compatible with both Windows and macOS while supporting files larger than 4 GB?

FAT32
NTFS
exFAT (Correct answer)
ReFS

Correct answer: exFAT

exFAT removes FAT32's 4 GB file size limit and is natively supported by both Windows and macOS without third-party drivers.

Question 39: Techuisitive Microsoft Endpoint Manager administrator. The company recently installed 5 computers in the common area for employees to check their personal emails or visit unsecure websites. <br> Make sure employees can use Microsoft Edge without signing in. These computers should not allow employees to use other applications. Use which device configuration profile type?

Kiosk (Correct answer)
Device Restriction
Administrative Templates
Endpoint Protection

Correct answer: Kiosk

A Kiosk device configuration profile in Microsoft Intune is specifically designed to lock down a device for a single purpose or a limited set of applications. This profile type allows administrators to configure a device to run only specific applications (like Microsoft Edge) and prevent users from accessing other parts of the operating system, making it ideal for public-use computers.

Question 40: Which command extends a simple volume on a dynamic disk using all available unallocated space from the command line?

fsutil extend
chkdsk /extend
diskpart > extend (Correct answer)
format /extend

Correct answer: diskpart > extend

In DiskPart, selecting the volume and running 'extend' expands it into adjacent unallocated space.

Question 41: Which IPv6 address type is equivalent to an IPv4 private address and is routable only within a local network?

Unique Local Address (ULA) fc00::/7 (Correct answer)
Global Unicast Address 2000::/3
Multicast Address ff00::/8
Link-Local Address fe80::/10

Correct answer: Unique Local Address (ULA) fc00::/7

Unique Local Addresses (ULA) in the fc00::/7 range are the IPv6 equivalent of IPv4 private addresses.

Question 42: Which Windows Hello authentication method uses facial recognition to sign in to Windows 10?

Windows Hello FIDO2
Windows Hello PIN
Windows Hello Fingerprint
Windows Hello Face (Correct answer)

Correct answer: Windows Hello Face

Windows Hello Face uses an IR camera to perform biometric facial recognition for passwordless sign-in.

Question 43: Which NTFS permission allows a user to list files in a folder but not read file contents?

Traverse Folder
Read
List Folder Contents (Correct answer)
Read & Execute

Correct answer: List Folder Contents

The 'List Folder Contents' permission lets users see file and subfolder names without granting access to read the actual file data.

Question 44: What does enabling 'Exploit protection' in Windows Security help prevent?

Network intrusions from the internet
Unauthorized user account creation
Malicious email attachments
Memory-based exploits such as buffer overflows and heap spraying (Correct answer)

Correct answer: Memory-based exploits such as buffer overflows and heap spraying

Exploit protection applies DEP, ASLR, CFG, and other memory protections to processes to block common exploit techniques.

Question 45: Which Windows 10 feature helps prevent data loss by enabling IT to control whether apps can copy corporate data to personal storage locations?

AppLocker
Windows Information Protection (WIP) (Correct answer)
Controlled Folder Access
BitLocker

Correct answer: Windows Information Protection (WIP)

WIP (formerly EDP) classifies corporate vs. personal data and enforces policies to prevent leakage between the two.

Question 46: What does the 'msconfig' System Configuration utility primarily allow a technician to do?

Manage Windows Update settings
Edit the system PATH variable
Configure startup options, boot settings, and selectively disable startup programs and services for troubleshooting (Correct answer)
Permanently remove startup programs

Correct answer: Configure startup options, boot settings, and selectively disable startup programs and services for troubleshooting

Msconfig is a diagnostic tool that lets technicians perform selective startups to isolate problems by disabling services or startup apps.

Question 47: What is the purpose of the Windows Program Compatibility Troubleshooter?

Updates application drivers
Uninstalls incompatible applications
Moves apps to a compatible OS partition
Automatically detects and recommends compatibility settings for applications that don't run correctly (Correct answer)

Correct answer: Automatically detects and recommends compatibility settings for applications that don't run correctly

The Program Compatibility Troubleshooter tests different compatibility modes and settings to identify what makes an older app work on Windows 10.

Question 48: Which file system is required to use features like file-level encryption (EFS) and disk quotas on Windows 10?

exFAT
FAT32
NTFS (Correct answer)
ReFS

Correct answer: NTFS

NTFS (New Technology File System) supports advanced features including EFS encryption, disk quotas, compression, and granular permissions.

Question 49: A technician needs to see which local users are currently logged on to a Windows 10 system. Which command should they use?

net session
query user (Correct answer)
tasklist /v
whoami /all

Correct answer: query user

The 'query user' command lists all users currently logged on locally or via Remote Desktop along with their session details.

Question 50: Which Windows 10 Pro feature allows administrators to control which applications users are allowed to run using publisher, path, or hash rules?

AppLocker (Correct answer)
Controlled Folder Access
Windows Defender Application Guard
Software Restriction Policies

Correct answer: AppLocker

AppLocker lets administrators define rules that allow or deny execution of applications based on file attributes.

MD-100: Windows Client

MD-100 validates IT professionals' expertise in installing, configuring, and maintaining Windows clients within a domain infrastructure. It covers Windows deployment, connectivity, storage, maintenance, and security/data protection in Microsoft Entra environments.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds