MD-102 Exam — Questions and Answers

Question 1: Which authentication strength setting in Azure AD Conditional Access enforces phishing-resistant MFA methods only?

Windows Hello strength
Passwordless MFA strength
Phishing-resistant MFA strength (Correct answer)
MFA strength

Correct answer: Phishing-resistant MFA strength

The Phishing-resistant MFA strength in Conditional Access restricts authentication to methods immune to phishing, such as FIDO2 keys and Windows Hello for Business.

Question 2: Which file contains the configuration settings for an unattended Windows installation, allowing administrators to automate responses to setup prompts?

setup.ini
winpeshl.ini
bootstrap.cmd
autounattend.xml (Correct answer)

Correct answer: autounattend.xml

The autounattend.xml file contains pre-defined answers to Windows setup prompts, enabling fully automated unattended installations when placed at the root of installation media.

Question 3: Which Intune feature allows IT to detect non-compliant device configurations and automatically remediate them using custom scripts?

Device compliance policy
PowerShell scripts
Endpoint security baselines
Proactive remediations (Remediations) (Correct answer)

Correct answer: Proactive remediations (Remediations)

Proactive remediations (now called Remediations) in Intune run detection and remediation script pairs to identify and fix configuration issues on managed Windows endpoints.

Question 4: What is the purpose of running Sysprep /generalize before capturing a Windows image?

It enables BitLocker on the reference device
It compresses the Windows image to save disk space
It installs the latest Windows updates on the reference device
It removes machine-specific information so the image can be deployed to multiple devices (Correct answer)

Correct answer: It removes machine-specific information so the image can be deployed to multiple devices

Sysprep /generalize removes machine-specific data such as the SID and hardware identifiers, allowing the same image to be deployed to many different devices, each receiving a unique identity.

Question 5: An administrator wants to prevent users from copying corporate data from Microsoft 365 apps to personal apps on Windows devices. Which Intune feature addresses this?

Endpoint security Firewall policy
Device compliance policy
Device configuration Device restrictions
App protection policies (MAM) (Correct answer)

Correct answer: App protection policies (MAM)

App protection policies (Mobile Application Management) in Intune can restrict data transfer between managed apps and unmanaged personal apps, preventing corporate data leakage.

Question 6: Which attack surface reduction rule prevents Office applications from creating executable content (such as .exe files)?

Block credential stealing from Windows LSASS
Block Office applications from creating executable content (Correct answer)
Block executable files from running unless they meet a prevalence criterion
Use advanced protection against ransomware

Correct answer: Block Office applications from creating executable content

The ASR rule 'Block Office applications from creating executable content' prevents macro-enabled Office files from writing and executing malicious payloads.

Question 7: A company is using Configuration Manager and wants to start managing devices with Intune as well. What feature enables both tools to manage the same devices simultaneously?

Autopilot hybrid join
Co-management (Correct answer)
Intune gateway
Tenant attach

Correct answer: Co-management

Co-management allows devices to be simultaneously managed by both Configuration Manager and Microsoft Intune, with workloads split between the two tools.

Question 8: You need to assign the same deployment profile to all the computers that are configured by using Windows Autopilot. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Create an Azure AD group that has dynamic membership rules and uses the ZTDID tag. (Correct answer)
Create an Azure AD group that has dynamic membership rules and uses the operating System tag.
Join the computers to Azure AD.
Join the computers to an on-premises Active Directory domain.
Create a Group Policy object (GPO) that is linked to a domain.
Assign a Windows Autopilot deployment profile to a group. (Correct answer)

Correct answer: Create an Azure AD group that has dynamic membership rules and uses the ZTDID tag.

To assign a deployment profile to all Windows Autopilot computers, you first need to group these devices. Creating an Azure AD group with dynamic membership rules using the ZTDID (Zero Touch Deployment ID) tag allows Autopilot-registered devices to automatically join. Once the group is populated, you can then assign the desired Windows Autopilot deployment profile to this specific Azure AD group, ensuring consistent configuration.

Question 9: Which Microsoft Intune report shows the enrollment status of all devices and whether they have successfully enrolled?

Device compliance report
Device enrollment failures report (Correct answer)
Device configuration report
Audit logs

Correct answer: Device enrollment failures report

The device enrollment failures report in Intune lists devices that failed to enroll, along with error codes and reasons, helping administrators troubleshoot enrollment issues.

Question 10: During Windows Autopilot self-deploying mode, which authentication type is used since no user credentials are entered?

Azure AD user password
Device certificate with TPM attestation (Correct answer)
FIDO2 security key
Windows Hello for Business PIN

Correct answer: Device certificate with TPM attestation

Autopilot self-deploying mode uses the device TPM chip for attestation and a device certificate to authenticate to Azure AD without requiring user credentials.

Question 11: A company deploys apps via Intune and wants to remove an app that is no longer needed from all devices. Which assignment type achieves this?

Not applicable
Available
Required
Uninstall (Correct answer)

Correct answer: Uninstall

The 'Uninstall' assignment type in Intune removes the application from targeted devices or users automatically.

Question 12: Which co-management workload must be switched to Intune to manage Windows Update policies using Windows Update for Business rings?

Device compliance
Windows Update policies (Correct answer)
Endpoint Protection
Resource access policies

Correct answer: Windows Update policies

The Windows Update policies co-management workload must be switched to Intune to allow Intune-based Windows Update for Business rings to take effect.

Question 13: You have a Microsoft 365 subscription that includes Microsoft Intune. You plan to use Windows Autopilot to deploy Windows 11 devices. You need to meet the following requirements during Autopilot provisioning: * Display the app and profile configuration progress. * Block users from using the devices until all apps and profiles are installed What should you configure?

an app configuration policy
an enrollment device platform restriction
an app protection policy
an enrollment status page (Correct answer)

Correct answer: an enrollment status page

The Enrollment Status Page (ESP) in Windows Autopilot is designed to display the progress of device setup, including app and profile configuration. It can also be configured to block users from using the device until all required applications and profiles are successfully installed. This ensures that devices are fully provisioned and compliant before users gain access, meeting both requirements.

Question 14: Which Intune app configuration policy delivery channel is used to configure settings for managed apps on enrolled devices?

Managed apps channel
Managed devices channel (Correct answer)
App protection policy
MAM without enrollment

Correct answer: Managed devices channel

App configuration policies for managed devices deliver configuration settings through the MDM channel to apps installed on enrolled Intune-managed devices.

Question 15: Your network contains an Active Directory domain named contoso.com. The domain contains 25 computers that run Windows 11. You have a Microsoft 365 subscription You have an Azure AD tenant that syncs with contoso.com. You configure hybrid Azure AD join and discover that some of the computers have a registered state of Pending. You need to ensure that the computers complete the join successfully. What should you ensure?

that the computers contain the latest quality updates
that Windows is activated on all the computers
that each computer has a line of sight to a domain controller (Correct answer)
that the users of the computers are assigned Microsoft 365 licenses

Correct answer: that each computer has a line of sight to a domain controller

For hybrid Azure AD join to complete successfully, the computers need to be able to communicate directly with an on-premises Active Directory domain controller. This 'line of sight' is crucial for the device registration process, as the domain controller is responsible for syncing the device object to Azure AD. Without this connectivity, the device registration can remain in a 'Pending' state.

Question 16: An endpoint administrator wants to configure a Windows device to use a proxy server for internet traffic. Which Intune profile type supports this configuration?

Compliance policy
Device configuration profile (Wi-Fi)
Device configuration profile (Proxy settings) (Correct answer)
Device restrictions profile

Correct answer: Device configuration profile (Proxy settings)

Intune device configuration profiles include proxy settings that let administrators define proxy server address, port, and bypass rules for Windows devices.

Question 17: Which Azure AD role has the least privilege to manage Intune device compliance policies?

Intune Administrator (Correct answer)
Global Administrator
Compliance Administrator
Security Administrator

Correct answer: Intune Administrator

The Intune Administrator role provides the necessary permissions to manage device compliance policies without granting full Global Administrator access.

Question 18: Which Windows ADK component is required for creating bootable WinPE media used during OS deployment?

Windows Preinstallation Environment (WinPE) add-on (Correct answer)
User State Migration Tool (USMT)
Windows Performance Toolkit
Application Compatibility Toolkit

Correct answer: Windows Preinstallation Environment (WinPE) add-on

The Windows PE add-on for the Windows ADK provides the tools needed to create bootable WinPE media used during OS deployment tasks.

Question 19: An admin wants to ensure that when a user's risk level is detected as high, their session is blocked. Which Azure AD feature supports this?

Identity Protection – User risk policy
Identity Protection – Sign-in risk policy
Conditional Access – Sign-in risk policy
Conditional Access – User risk policy (Correct answer)

Correct answer: Conditional Access – User risk policy

A Conditional Access user risk policy can be configured to block access when Azure AD Identity Protection detects that a user's risk level is high.

Question 20: Which Intune policy can prevent users from modifying Microsoft Defender Antivirus settings on their Windows 10 devices?

Tamper protection setting in Antivirus policy (Correct answer)
Endpoint security baseline
App protection policy
Device restriction configuration profile

Correct answer: Tamper protection setting in Antivirus policy

Tamper protection, configured through the Intune Antivirus policy, prevents users and malware from modifying Microsoft Defender Antivirus security settings.

Question 21: Which Self-Service Password Reset (SSPR) setting allows users to reset their password using an authenticator app notification?

Mobile app notification (Correct answer)
Office phone
Security questions
Email authentication

Correct answer: Mobile app notification

The mobile app notification method in SSPR allows users to approve a password reset through a push notification sent to their Microsoft Authenticator app.

Question 22: An Intune administrator needs to ensure all VPN traffic routes through the corporate network rather than directly to the internet. Which VPN setting should be configured?

Disable split tunnelling to route all traffic through VPN (Correct answer)
Set DNS suffix search list
Enable per-app VPN
Enable IKEv2 fragmentation

Correct answer: Disable split tunnelling to route all traffic through VPN

Disabling split tunnelling forces all device traffic through the VPN tunnel rather than routing internet traffic directly, ensuring corporate security policies apply to all traffic.

Question 23: What is the recommended maximum deferral period for quality (security) updates in Windows Update for Business?

7 days
60 days
90 days
30 days (Correct answer)

Correct answer: 30 days

Microsoft recommends deferring quality updates by no more than 30 days to ensure devices receive critical security patches in a timely manner while still allowing validation time.

Question 24: Which Windows Autopilot deployment mode allows IT to pre-provision a device so it is fully configured before being handed to the end user?

Hybrid join mode
User-driven mode
Pre-provisioning mode (Correct answer)
Self-deploying mode

Correct answer: Pre-provisioning mode

Pre-provisioning mode (White Glove) allows IT or a partner to complete most of the Autopilot setup before the device reaches the end user.

Question 25: Which Intune report shows how many devices have a specific application installed?

App install status report (Correct answer)
Endpoint analytics app reliability report
Device compliance report
Device configuration report

Correct answer: App install status report

The app install status report in Intune shows the installation status of a specific app across all targeted devices, including successful installations, failures, and pending installations.

Question 26: Which action in Intune allows an administrator to remove corporate data from a device while leaving personal data intact?

Fresh start
Factory reset (wipe)
Retire (Correct answer)
Delete

Correct answer: Retire

The Retire action in Intune removes only corporate-managed data, apps, and configuration from a device, preserving the user's personal data and apps.

Question 27: In Microsoft Intune, what is the maximum number of days you can defer a Windows quality update using an update ring policy?

14 days
35 days (Correct answer)
7 days
30 days

Correct answer: 35 days

Windows quality updates (cumulative updates) can be deferred up to 35 days using update ring policies in Microsoft Intune.

Question 28: What is the purpose of app requirement rules in Win32 app deployment in Intune?

Detect if the app is already installed
Set the minimum OS version for the device
Define prerequisites that must be met before the app installation begins (Correct answer)
Configure app assignment groups

Correct answer: Define prerequisites that must be met before the app installation begins

Requirement rules in Intune Win32 app deployment define prerequisite conditions (such as OS version, disk space, or registry keys) that must be satisfied before Intune attempts to install the app.

Question 29: What does the Enrollment Status Page (ESP) do during Windows Autopilot deployment?

It captures diagnostic logs and uploads them to Intune
It records the device in the Autopilot hardware hash database
It sends an email notification when enrollment is complete
It blocks the user from accessing the desktop until required apps and policies are applied (Correct answer)

Correct answer: It blocks the user from accessing the desktop until required apps and policies are applied

The Enrollment Status Page prevents the user from accessing the desktop or apps until all required configurations, applications, and policies have been successfully applied to the device.

Question 30: A conditional access policy is set to require compliant device. A user signs in from an unmanaged personal device. What happens?

The user is granted access with limited permissions
The user is prompted to enroll the device in Intune
The user is redirected to a web app portal
Access is blocked (Correct answer)

Correct answer: Access is blocked

When a Conditional Access policy requires a compliant device and the device is unmanaged, access is blocked because compliance status cannot be verified.

Question 31: Which Windows Autopilot deployment mode allows a technician to pre-configure a device before handing it to the end user?

Pre-provisioning (white glove) mode (Correct answer)
Reset mode
User-driven mode
Self-deploying mode

Correct answer: Pre-provisioning (white glove) mode

Pre-provisioning (white glove) mode allows IT staff or partners to complete the Autopilot provisioning process on behalf of the user so the device is fully configured before reaching the end user.

Question 32: Which license is required to use Azure AD Privileged Identity Management (PIM)?

Azure AD Premium P1
Azure AD Free
Azure AD Premium P2 (Correct answer)
Microsoft 365 Business Basic

Correct answer: Azure AD Premium P2

Azure AD Privileged Identity Management requires Azure AD Premium P2 licenses to provide just-in-time privileged access management.

Question 33: What is the minimum requirement for a device to be eligible for Windows Autopilot deployment?

The device must be domain-joined
The device hardware hash must be registered in Intune or Autopilot (Correct answer)
The device must have a TPM 2.0 chip
The device must have Windows 10 Pro or higher installed

Correct answer: The device hardware hash must be registered in Intune or Autopilot

For Autopilot to recognise and configure a device automatically, its hardware hash must be registered in Microsoft Intune or the Autopilot deployment service.

Question 34: An admin wants to enroll Android devices in a mode where the company owns and fully manages the entire device. Which enrollment type should be used?

Android Enterprise fully managed (Correct answer)
Android Enterprise work profile
Android Enterprise dedicated
Android device administrator

Correct answer: Android Enterprise fully managed

Android Enterprise fully managed enrollment gives the organization complete control over the entire device, typically used for corporate-owned devices with a single primary user.

Question 35: An administrator wants to assign specific Windows Autopilot deployment profiles to devices based on their department. Which mechanism in Intune achieves this?

Endpoint analytics assignment
Compliance policies with group filters
SCEP certificate profiles
Device categories and dynamic groups (Correct answer)

Correct answer: Device categories and dynamic groups

Device categories in Intune allow administrators to classify devices, which can then be used with dynamic Azure AD groups to automatically assign the correct Autopilot profile based on the device category.

Question 36: Which Windows tool allows administrators to service an offline Windows image by adding drivers, updates, or language packs before deployment?

Sysprep
Windows SIM
DISM (Deployment Image Servicing and Management) (Correct answer)
BCDEdit

Correct answer: DISM (Deployment Image Servicing and Management)

DISM can mount a Windows image offline and add or remove drivers, cumulative updates, features, and language packs without booting the image.

Question 37: Which protocol does Windows Hello for Business use for authentication in a key trust deployment?

OAuth 2.0
SAML
NTLM
Kerberos (Correct answer)

Correct answer: Kerberos

Windows Hello for Business key trust uses Kerberos for on-premises authentication by leveraging the user's key credential registered in AD.

Question 38: An administrator wants to deploy a PowerShell script to Windows 10 devices using Intune. Which feature should be used?

Intune PowerShell scripts (Correct answer)
Win32 app deployment
Device configuration profile
Proactive remediation

Correct answer: Intune PowerShell scripts

Intune PowerShell scripts allow administrators to deploy and execute PowerShell scripts on Windows 10/11 devices managed by Intune.

Question 39: In Microsoft Intune, which profile type is used to configure Wi-Fi settings and push them to managed Windows devices?

Compliance policy
Endpoint protection profile
Update ring
Device configuration profile (Correct answer)

Correct answer: Device configuration profile

Device configuration profiles in Intune are used to push settings such as Wi-Fi networks, VPN connections, email, and certificates to managed devices.

Question 40: An administrator needs to check which Windows updates are installed on a specific managed device from the Intune portal. Where should they look?

Reports > Endpoint analytics > Device performance
Devices > Monitor > Windows Update > Feature update failures
Devices > Select device > Monitor > Windows update installations (Correct answer)
Devices > Device compliance

Correct answer: Devices > Select device > Monitor > Windows update installations

In Intune, navigating to a specific device and selecting Monitor then Windows update installations shows the update history for that device, including installed updates and any failures.

Question 41: A company wants to prevent users from copying corporate data from managed apps to personal apps on iOS. Which Intune feature should be configured?

App protection policy (MAM) (Correct answer)
Device compliance policy
Conditional Access policy
iOS device restriction profile

Correct answer: App protection policy (MAM)

App protection policies (MAM) in Intune control data transfer between managed and unmanaged apps, preventing corporate data from being pasted or saved to personal apps on iOS.

Question 42: What is the recommended approach for managing Microsoft 365 Apps update channels within Microsoft Intune?

Use the Microsoft 365 Apps Update channel policy under App configuration (Correct answer)
Configure update rings for Office
Manually deploy Office updates via Win32 apps
Use Windows Update for Business policies

Correct answer: Use the Microsoft 365 Apps Update channel policy under App configuration

Microsoft 365 Apps update channels are managed through App configuration policies in Intune, which control which update channel (Monthly Enterprise, Current, etc.) is used for Office apps.

Question 43: An Intune enrollment restriction is configured to block Android devices. A user tries to enroll an Android phone. What happens?

The user sees an error and enrollment fails (Correct answer)
The admin receives an alert but enrollment succeeds
The device enrolls but gets no policies
The device enrolls as a non-compliant device

Correct answer: The user sees an error and enrollment fails

Enrollment restrictions in Intune prevent devices that match blocked criteria from enrolling, resulting in an error message shown to the user.

Question 44: You have a Microsoft 365 subscription that includes Microsoft Intune. The subscription contains corporate-owned, fully managed Android Enterprise devices. You plan to deploy a configuration profile that will have a device restrictions profile type named Profile1. Profile1 will assign maintenance windows for system updates. What should you configure from the Configuration settings for Profile1?

Connectivity
Power Settings Explanation
General
Device experience (Correct answer)

Correct answer: Device experience

For Android Enterprise corporate-owned, fully managed devices, settings related to system updates, including defining maintenance windows, are found under the "Device experience" category within a device restrictions configuration profile. This section allows administrators to control various aspects of the device's user experience and operational behavior, such as update policies, kiosk modes, and display settings.

Question 45: What does Credential Guard in Windows 10 protect against?

Unauthorized USB access
Ransomware file encryption
Pass-the-hash and pass-the-ticket attacks (Correct answer)
Phishing website access

Correct answer: Pass-the-hash and pass-the-ticket attacks

Windows Defender Credential Guard uses virtualization-based security to isolate LSASS secrets, protecting against pass-the-hash and pass-the-ticket credential theft attacks.

Question 46: You plan to deploy Windows 11 Pro to 200 new computers by using the Microsoft Deployment Toolkit (MDT) and Windows Deployment Services (WDS). The company has a Volume Licensing Agreement and uses a product key to activate Windows 11. You need to ensure that the new computers will be configured to have the correct product key during the installation. What should you configure?

a Windows Autopilot deployment profile
an MDT task sequence (Correct answer)
a WDS boot image
the Device settings in Azure AD

Correct answer: an MDT task sequence

When deploying Windows with MDT, the product key for activation is configured within the MDT task sequence. The task sequence orchestrates all steps of the deployment, including operating system installation, driver injection, application installation, and crucially, the entry of the product key for volume licensing. This ensures that all 200 new computers are correctly activated during the automated deployment process.

Question 47: What is Windows Information Protection (WIP) designed to do?

Encrypt hard drives using BitLocker across the enterprise
Block access to corporate data when a device is non-compliant
Separate and protect corporate data from personal data on Windows devices without requiring full MDM enrollment (Correct answer)
Enforce password policies on Windows devices

Correct answer: Separate and protect corporate data from personal data on Windows devices without requiring full MDM enrollment

Windows Information Protection (WIP) provides data separation on Windows devices, tagging corporate data and restricting how it can be shared or copied to non-corporate apps, without requiring full MDM enrollment.

Question 48: What does enabling Expedite in a Windows Update for Business quality update policy do?

It prioritises the update download over other network traffic
It defers the update by the minimum possible deferral period
It sends the update as a push notification to users
It immediately installs the update on all assigned devices, overriding deferral settings (Correct answer)

Correct answer: It immediately installs the update on all assigned devices, overriding deferral settings

Expediting a quality update in Intune overrides deferral settings and forces all assigned devices to install the specified security update as quickly as possible, used for critical vulnerabilities.

Question 49: Which Intune app deployment type should be used to deploy a line-of-business (LOB) Win32 application to Windows 10 devices?

Web link
Win32 app (IntuneWin package) (Correct answer)
Windows app (Win32)
Microsoft Store app

Correct answer: Win32 app (IntuneWin package)

Win32 LOB apps are packaged using the Microsoft Win32 Content Prep Tool into an .intunewin file and deployed as a Win32 app type in Intune.

Question 50: Which Windows security feature prevents untrusted applications from running on a device by allowing only signed and trusted software?

Secure Boot
Windows Firewall
Windows Defender Application Control (WDAC) (Correct answer)
Windows Defender Credential Guard

Correct answer: Windows Defender Application Control (WDAC)

Windows Defender Application Control (WDAC) enforces code integrity policies that allow only trusted and signed applications to execute on Windows devices.

MD-102 Exam

The MD-102 Microsoft Endpoint Administrator exam validates skills in deploying Windows client, managing identity and compliance, managing and protecting devices, and managing applications using Microsoft Intune and related technologies.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Renewal, score validity, score release, eligibility, fees, time limit, exam format · verified Nov 2026
home.pearsonvue.com — Test delivery · verified Nov 2026