MD-102 Practice Test

The MD-102 Endpoint Administrator exam is a crucial certification for IT professionals aiming to demonstrate their expertise in managing and securing endpoints in a Microsoft environment. As organizations increasingly rely on technology, the role of an endpoint administrator has become pivotal in ensuring the smooth operation of IT systems. This article explores into key areas of the MD-102 exam, providing insights into Microsoft Endpoint Manager, desktop management, device configuration, endpoint security, and compliance management. Practice with the free MD-102 - Endpoint Administrator practice test on PracticeTestGeeks (7 questions with answer explanations).

MD-102 Exam at a Glance

What changed for MD-102 in 2026

• Nov 1, 2026: Delivery changed to In-person at a Pearson VUE test center or online proctored (previously In-person at Pearson VUE test centers or online via OnVUE).^[5]
• Nov 1, 2026: Eligibility changed to Experience with Microsoft Entra ID, Microsoft 365, and Intune; no formal prerequisite (previously Experience with Entra ID, Microsoft 365, and Intune; no formal prerequisite).^[2]
• Nov 1, 2026: Renewal changed to Free unproctored online assessment annually within 6-month window (previously Free online unproctored assessment, six-month window).^[4]

Free MD-102 - Endpoint Administrator Exam Study Tools

Interactive MD-102 - Endpoint Administrator Exam resources on PracticeTestGeeks, free to start:

• MD-102 - Endpoint Administrator Exam flashcards — review key terms and concepts card by card
• MD-102 - Endpoint Administrator Exam study guide — topic-by-topic overview of what the exam covers
• MD-102 - Endpoint Administrator Exam cheat sheet — one-page printable summary for last-minute review

According to Microsoft, “Most Microsoft Certification exams typically contain between 40-60 questions; however, the number can vary depending on the exam.”^[1]

MD-102 content outline and where to practise each area

The content areas below are copied from the official MD-102 content outline published by Microsoft. The right-hand column shows which of our practice sets covers it.

Worked examples: how to reason through MD-102 questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: What is the minimum requirement for a device to be eligible for Windows Autopilot deployment?

1. The device must be domain-joined
2. The device hardware hash must be registered in Intune or Autopilot
3. The device must have Windows 10 Pro or higher installed
4. The device must have a TPM 2.0 chip

Answer: B. The device hardware hash must be registered in Intune or Autopilot

Explanation:

The correct answer is that the device hardware hash must be registered in Intune or Autopilot. Autopilot identifies a device by that hash. Without it the service has no record of the device, so it cannot apply a deployment profile when the device first connects.

Domain-joined is wrong because Autopilot is built for cloud-based provisioning and does not need an on-premises domain join to start. Windows 10 Pro or higher is wrong because the edition is not the test of eligibility; registration is. TPM 2.0 is wrong because it matters for certain scenarios such as self-deploying and pre-provisioned modes, but it is not the minimum requirement for the device to be eligible at all.

Rule to remember: Autopilot works on registered devices. If a question asks what makes a device known to the service, look for the hardware hash and registration, not for hardware features or domain membership.

Example 2

Question: You have a Windows 10 device named Computer1 enrolled in Microsoft Intune. You need to configure Computer1 as a public workstation that will run a single customer-facing, full-screen application. Which configuration profile type template should you use in Microsoft Intune admin center?

1. Shared multi-user device
2. Device restrictions
3. Kiosk
4. Endpoint protection

Answer: C. Kiosk

Explanation:

The correct answer is Kiosk. A kiosk profile locks a device to a specified app, here a single customer-facing full-screen application, and blocks access to the rest of the system. That matches a public workstation exactly.

Shared multi-user device is wrong because it configures how several different people sign in and share a device, not how to lock it to one app. Device restrictions is wrong because it controls individual settings and features, but it does not turn the device into a single-app experience. Endpoint protection is wrong because it covers security features such as firewall and encryption settings, not the user experience.

Rule to remember: when the scenario says one app, full screen, public or customer-facing, think kiosk. When it says many users on one device, think shared device. Match the wording of the scenario to the purpose of the profile template.

Example 3

Question: You are assigned a task to restrict access for Android Smartphones from accessing Organizational data. You should find and restrict the access for smartphones that don’t have the latest version of the security patch and can give a maximum 90 days of grace period for the users to update their smartphones. Which of the following can be used to achieve this task?

1. Notify end users through email
2. Google Play Protect
3. Encryption of data
4. Mark device non-compliant

Answer: D. Mark device non-compliant

Explanation:

The correct answer is Mark device non-compliant. In a compliance policy you set the required security patch level, then define actions for noncompliance. Those actions include a grace period, which here is the maximum 90 days. Once the grace period ends, the device is marked non-compliant, and conditional access can then block it from organizational data.

Notify end users through email is wrong because a notification alone does not restrict anything; it is only a supporting action. Google Play Protect is wrong because it scans for harmful apps and is not a patch-level enforcement control. Encryption of data is wrong because it protects stored data but does not check how current the security patch is.

Rule to remember: compliance policies decide whether a device meets your standard, and conditional access enforces the result. Grace periods belong to the noncompliance action.

How to use these practice tests

Start with the official skills outline on Microsoft Learn and read it against the list of areas above. Mark each area as comfortable, shaky or unfamiliar. Be honest, because the purpose is to decide where your time goes.

Then take the practice test once without notes to see where you stand. Do not worry about the score. Use it to sort topics into those you can skip for now and those that need work.

Work through the topic sets for your weak areas, such as enrolling devices, managing applications and protecting endpoints. After each wrong answer, read the explanation, then open the matching Microsoft Learn page and find the setting in the Intune admin center if you have a test tenant. Seeing the real menu fixes the idea in memory far better than rereading.

Write a short note for every mistake: what the question was really asking and which rule decides it. Review those notes in the last days before the exam.

Finally, read the exam duration and format page on Microsoft Learn so the 100 minute limit and question style are familiar before you book.

Key Takeaways

• Master Microsoft Endpoint Manager: Understand its features and capabilities for effective endpoint management.
• Focus on Desktop and Device Management: Develop skills in deploying, configuring, and managing desktops and devices.
• Prioritize Endpoint Security: Implement strong security measures to protect against various threats.
• Ensure Compliance: Stay informed about regulatory requirements and enforce compliance policies.

Microsoft Endpoint Manager

Microsoft Endpoint Manager (MEM) is a crucial platform for managing and securing endpoints. It integrates various services, such as Microsoft Intune and Configuration Manager, to provide a unified approach to endpoint management. Key features of MEM include:

• Centralized Management: Simplifies the administration of devices, applications, and user policies from a single console.
• Integration with Microsoft 365: Seamlessly integrates with Microsoft 365 services, enhancing productivity and collaboration.
• Cloud and On-Premises Solutions: Offers flexibility to manage devices through cloud-based or on-premises solutions.

Familiarity with MEM is essential for the MD-102 exam. Candidates should understand how to configure and deploy MEM, as well as troubleshoot common issues.

Desktop Management

Desktop management involves configuring and maintaining desktop systems to ensure they are secure, functional, and compliant with organizational policies. Key aspects include:

• Operating System Deployment: Knowledge of deploying Windows operating systems using tools like Microsoft Deployment Toolkit (MDT) or Windows Autopilot.
• Application Deployment: Proficiency in deploying and managing applications across desktops using tools like Microsoft Intune or Configuration Manager.
• User Profiles and Data Management: Ability to manage user profiles, roaming profiles, and redirect folders to ensure data is secure and accessible.

Effective desktop management is crucial for maintaining productivity and ensuring a consistent user experience across devices.

Device Configuration

Device configuration is a fundamental aspect of endpoint management. This involves setting up and managing device settings to ensure they meet organizational requirements. Key elements include:

• Group Policy Management: Understanding how to create and manage Group Policies to enforce security settings and configurations.
• Profile Configuration: Configuring device profiles for different types of devices, such as laptops, tablets, and smartphones.
• Compliance Policies: Implementing and managing compliance policies to ensure devices adhere to organizational and regulatory standards.

Proper device configuration helps in maintaining security, ensuring compliance, and optimizing device performance.

Endpoint Security

Endpoint security is a critical domain in the MD-102 exam. It focuses on protecting devices from threats and vulnerabilities. Key areas to cover include:

• Threat Protection: Implementing and managing security solutions to protect against malware, ransomware, and other threats.
• Encryption: Using encryption technologies to protect sensitive data on endpoints.
• Firewall and Network Security: Configuring firewalls and network security settings to safeguard against unauthorized access.

A solid understanding of endpoint security principles and practices is essential for safeguarding organizational data and ensuring a secure computing environment.

Compliance Management

Compliance management ensures that devices and systems adhere to regulatory and organizational standards. Key topics include:

• Regulatory Requirements: Understanding and implementing compliance requirements such as GDPR, HIPAA, and other industry-specific regulations.
• Audit and Reporting: Using tools and techniques to conduct audits and generate reports to demonstrate compliance.
• Policy Enforcement: Implementing and enforcing policies to maintain compliance across all endpoints.

Effective compliance management is vital for avoiding legal issues and maintaining a secure and trustworthy IT environment.

Conclusion

The (MD-102) Endpoint Administrator Exam assesses your ability to manage and secure endpoints in a Microsoft environment. By focusing on Microsoft Endpoint Manager, desktop management, device configuration, endpoint security, and compliance management, you will be well-prepared for the exam. Invest time in understanding these key areas, practice regularly, and stay updated with the latest trends and technologies.

MD-102 Questions and Answers

Sources & last verified

1. Microsoft — number of questions (official source). “Most Microsoft Certification exams typically contain between 40-60 questions; however, the number can vary depending on the exam.” Verified Nov 1, 2026 · source checked Oct 17, 2026.
2. Microsoft — time limit, exam fee, eligibility (official source). “You will have 100 minutes to complete this assessment.” Verified Nov 1, 2026.
3. Microsoft — validity (official source). “Microsoft role-based (associate and expert) and specialty Certifications are valid for one (1) year from the date that you complete all requirements to earn that…” Verified Nov 1, 2026 · source checked Oct 29, 2026.
4. Microsoft — renewal (official source). “You can take the renewal assessment any time during your six-month eligibility window, via Microsoft Learn. Once you pass, your certification will be extended one…” Verified Nov 1, 2026 · source checked Oct 17, 2026.
5. home.pearsonvue.com — delivery (official source). “Microsoft states that candidates can usually choose between a local test center and an online proctored exam, depending on availability for that exam and provider.” Verified Nov 1, 2026.
6. Microsoft — score release (official source). “For most exams, you’ll have results within minutes of finish the exam. You’ll also get a report with your exam score and feedback on your…” Verified Nov 1, 2026 · source checked Oct 17, 2026.
7. Microsoft — other (official source). “manage and maintain devices” Verified Nov 1, 2026.

How we verify: editorial & fact-checking policy. Report an error: contact us.

Pros and Cons at a Glance

Sample MD-102 - Endpoint Administrator Exam Practice Questions

Try these questions from our free MD-102 - Endpoint Administrator Exam practice tests. The correct answer and an explanation follow each question.

1. An endpoint administrator configures an update ring with a 10-day feature update deferral. What is the maximum deferral period allowed for feature updates?

   • A. 90 days
   • B. 180 days
   • C. 365 days
   • D. 730 days

Answer: C. 365 days

Feature updates can be deferred for up to 365 days (one year) using Windows Update for Business policies configured in Microsoft Intune.

Answer: C. Device configuration profile (Proxy settings)

Intune device configuration profiles include proxy settings that let administrators define proxy server address, port, and bypass rules for Windows devices.

Answer: A. Endpoint security – Attack surface reduction

Attack surface reduction policies in Intune include removable storage device controls that can block USB drives and other removable media on managed Windows devices.

Answer: B. Microsoft 365 Defender portal

The Microsoft 365 Defender portal (security.microsoft.com) aggregates security signals from Defender for Endpoint, Defender for Identity, and other services into a unified security dashboard.

Take the full MD-102 - Endpoint Administrator Exam practice test