MD-102: Microsoft Endpoint Administrator Practice Exam

What the MD-102 exam covers

• Prepare infrastructure for devices165 questions
• Manage and maintain devices185 questions
• Protect devices126 questions
• Manage and secure applications136 questions
• Optimize endpoint operations by using automation, monitoring, and reporting95 questions

Free MD-102 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 707.

1. Question 1Manage and maintain devices

   Your organization plans to deploy Windows 11 to 500 new devices using Windows Autopilot. You need to ensure that devices are automatically enrolled in Microsoft Intune during the out-of-box experience (OOBE). What must you do first?

   • AInstall the Microsoft Intune Company Portal app on each device
   • BCreate a Group Policy Object (GPO) that enables automatic MDM enrollment
   • CRegister the hardware hashes of the devices in Windows AutopilotCorrect
   • DCreate a provisioning package using Windows Configuration Designer
   ✓ Correct answer: C

   Windows Autopilot requires devices to be registered by their hardware hashes in the Autopilot service before deployment. The hardware hash is a unique identifier that associates the physical device with your tenant and enables Autopilot to recognize and provision the device automatically during OOBE. Registration with hardware hashes is the foundational step that must be completed before any other Autopilot configuration takes effect.

   Why the other options are wrong

   • AInstall the Microsoft Intune Company Portal app on each device is incorrect because the Company Portal is installed automatically during enrollment as part of the OOBE process, not as a prerequisite.
   • BCreate a Group Policy Object (GPO) that enables automatic MDM enrollment is incorrect because GPOs apply only to on-premises domain-joined devices and are not part of the Autopilot registration process.
   • DCreate a provisioning package using Windows Configuration Designer is incorrect because provisioning packages are optional tools that can supplement Autopilot deployment but are not required for basic hardware registration.
2. Question 2Prepare infrastructure for devices

   You are configuring a device compliance policy in Intune. You need to block devices that do not have BitLocker encryption enabled. Which compliance policy setting should you configure?

   • ASystem Security > Require encryptionCorrect
   • BConfiguration Manager Compliance > Require device compliance
   • CDevice Properties > Minimum OS version
   • DDevice Health > Require code integrity
   ✓ Correct answer: A

   The device compliance policy setting for BitLocker is located under System Security and specifically requires encryption of data storage on the device. This setting verifies that BitLocker is enabled on the device and that the encryption key is properly managed through the compliance framework. Non-compliant devices without BitLocker encryption can be automatically blocked from accessing company resources or isolated to remediation workflows.

   Why the other options are wrong

   • BConfiguration Manager Compliance > Require device compliance is incorrect because this setting verifies Configuration Manager compliance status, not BitLocker encryption specifically.
   • CDevice Properties > Minimum OS version is incorrect because this setting controls operating system version requirements, not encryption settings.
   • DDevice Health > Require code integrity is incorrect because that rule detects unsigned drivers or system files being loaded into the kernel and reports nothing about whether the drive is encrypted.
3. Question 3Prepare infrastructure for devices

   Adventure Works Cycles needs to manage Windows devices that are joined to on-premises Active Directory and registered with Microsoft Entra ID. What is this configuration called?

   • AMicrosoft Entra hybrid joinCorrect
   • BMicrosoft Entra join
   • CWorkplace Join
   • DMicrosoft Entra ID Registration
   ✓ Correct answer: A

   When Windows devices are joined to on-premises Active Directory and also registered with Microsoft Entra ID, the resulting identity state is hybrid Entra join. The device gains a synchronized object in both directories, enabling on-premises domain functionality alongside cloud features such as Conditional Access and Intune management. This dual registration is the defining characteristic of hybrid join. It is the standard model for organizations transitioning from AD toward cloud management.

   Why the other options are wrong

   • BMicrosoft Entra join is a cloud-only join with no on-premises Active Directory membership, so it does not describe a device tied to the local domain.
   • CWorkplace Join is the legacy name for registering personal devices for access and does not represent a domain-joined device synced to Entra ID.
   • DMicrosoft Entra ID Registration adds a personal or BYOD device to Entra for access only and does not include an on-premises domain join.
4. Question 4Prepare infrastructure for devices

   Woodgrove Bank uses Windows LAPS (Local Administrator Password Solution) with Microsoft Intune. The administrator needs to view the current local administrator password for a specific device. Where can they find this information?

   • AOn the device's Local admin password tab in IntuneCorrect
   • BIn the Microsoft 365 admin center under the device's Recovery keys
   • CBoth the Intune admin center and the Microsoft 365 admin center show the LAPS password
   • DIn Microsoft Entra ID under the device's BitLocker recovery keys
   ✓ Correct answer: A

   When Windows LAPS is configured through Microsoft Intune, the randomized local administrator password is backed up to Microsoft Entra ID, and administrators with the proper permissions retrieve it from the Intune admin center on the specific device's page under the 'Local admin password' tab. LAPS passwords are tied to device objects in the directory, so they surface on the device in the Intune admin center or on the device object in Microsoft Entra ID.

   Why the other options are wrong

   • BThe Microsoft 365 admin center does not surface a device Recovery keys node for LAPS; LAPS local administrator passwords are retrieved from the Intune admin center or the device object in Entra ID, not from the M365 admin center.
   • CNaming both locations is incorrect because the Microsoft 365 admin center is not a valid place to view the LAPS local administrator password; only the Intune admin center, or the device object in Entra ID, is.
   • DThe BitLocker recovery keys section holds drive encryption recovery keys, not the LAPS local administrator password, so it is the wrong retrieval point for this credential.
5. Question 5Protect devices

   An enterprise is enabling BitLocker on all Windows 11 devices managed by Intune. The administrator wants to ensure that BitLocker recovery keys are automatically stored in Microsoft Entra ID so that helpdesk staff can retrieve them if needed. How should the administrator configure this?

   • ACreate a PowerShell script deployed through Intune that enables BitLocker and uploads each recovery key to a dedicated Azure Blob Storage container
   • BCreate an Intune compliance policy that requires BitLocker encryption and reports non-compliant devices back to the administrators
   • CA device configuration profile (Endpoint Protection) storing recovery keys in Entra IDCorrect
   • DDeploy administrative-template Group Policy Objects through Intune to turn on BitLocker and back up each recovery key to the domain
   ✓ Correct answer: C

   The Endpoint Protection device configuration profile template includes BitLocker settings with a specific option to store recovery keys in Microsoft Entra ID (formerly Azure AD). This integration allows helpdesk staff to retrieve BitLocker recovery keys from the Entra ID portal when end users are locked out of their devices. This is the supported and recommended method within Intune for automating BitLocker recovery key escrow.

   Why the other options are wrong

   • ARecovery keys should escrow to Entra ID automatically; a script uploading them to Blob Storage is unsupported and insecure.
   • BA compliance policy only checks encryption status; it does not configure BitLocker or escrow recovery keys to Entra ID.
   • DGPO templates cannot escrow keys to Microsoft Entra ID; that requires the Endpoint Protection configuration profile.
6. Question 6Manage and secure applications

   You need to deploy a web application as a shortcut on Windows 11 desktops using Intune. Which app type should you use?

   • AMicrosoft 365 Apps
   • BLine-of-business app
   • CWeb linkCorrect
   • DWindows app (Win32)
   ✓ Correct answer: C

   Web links in Intune allow administrators to deploy browser shortcuts to managed devices without requiring traditional application installation packages. This app type is specifically designed for deploying shortcuts to web applications or online services directly to the desktop. The Web link app type creates a simple desktop shortcut that opens the specified URL in the default browser, making it ideal for accessing web-based applications.

   Why the other options are wrong

   • AMicrosoft 365 Apps is incorrect because it is used for deploying Microsoft Office applications, not web application shortcuts.
   • BLine-of-business app is incorrect because it is designed for internal applications packaged in specific formats like .intunewin or MSI, not web shortcuts.
   • DWindows app (Win32) is incorrect because it is used for deploying traditional Windows applications with installation packages, not web shortcuts.
7. Question 7Manage and maintain devices

   Adatum Corporation plans to use Windows Autopilot user-driven deployment for most new PCs. Why would administrators also plan for pre-provisioned deployment (formerly White Glove) in the same rollout?

   • APre-provisioned deployment replaces the Autopilot deployment profile, so neither mode needs a profile configured
   • BPre-provisioned deployment works only with Microsoft Entra hybrid join
   • CPre-provisioning completes device setup in advance, then the user completes the same sign-in stepCorrect
   • DA device set up through pre-provisioned deployment can never later be enrolled through user-driven Autopilot
   ✓ Correct answer: C

   Pre-provisioned deployment lets IT or a partner run the device-facing portion of provisioning, such as applying apps and policies, before the device reaches the user. The end user then completes only the brief, user-driven-style final steps like signing in with their own credentials. Both modes share the same Autopilot profile framework, so organizations commonly plan them together: some devices are pre-staged for fast readiness while others rely fully on self-service enrollment.

   Why the other options are wrong

   • ABoth deployment modes still require an Autopilot deployment profile to define OOBE settings and enrollment behavior.
   • BPre-provisioned deployment works with Microsoft Entra joined devices too; it is not restricted to hybrid join only.
   • DA pre-provisioned device finishes with the same brief sign-in steps used in user-driven deployment, not a separate enrollment path.
8. Question 8Manage and secure applicationsSelect all that apply

   Datum Corporation manages Android Enterprise fully managed devices. A company travel app that is already approved in managed Google Play must install on every device automatically, while a group of optional apps should appear in the managed Play Store for users to add themselves. The administrator must also be able to see, per device, whether the required app installed or failed. Which two should the administrator use? (Choose two.)

   • AManaged Google Play connector sync
   • BApp install status monitoringCorrect
   • CDiscovered apps
   • DApp uninstall assignment
   • EApp assignment typesCorrect
   ✓ Correct answer: B, E

   Once an app is approved in managed Google Play and synced into Intune, deployment is controlled by the assignment intent. A Required assignment installs the travel app on the targeted fully managed devices with no user action, while an Available assignment lists the optional apps in the managed Play Store on the device so users can add them themselves. Monitoring is separate: the app's Device install status report lists each targeted device as installed, failed or pending, with an error code for failures, so a failed rollout can be found without contacting users.

   Why the other options are wrong

   • ASyncing the managed Google Play connector brings newly approved apps into Intune. For an app that is already approved and synced, it neither targets devices nor reports installation outcomes.
   • CDiscovered apps is a slow software inventory of the apps found on enrolled devices. It is not a per-assignment result.
   • DAn uninstall assignment removes an app from the targeted devices, which is the opposite of both requirements.
9. Question 9Protect devicesSelect all that apply

   An administrator is reviewing how Microsoft Defender for Endpoint can respond to a compromised Windows 11 device. Which TWO automated or manual response actions can be initiated from the Microsoft Defender portal for an onboarded device?

   • ARun an antivirus scan on the deviceCorrect
   • BCollect an investigation package from the deviceCorrect
   • CReset the device's BitLocker recovery key from Defender
   • DChange the device's Microsoft Entra join type
   ✓ Correct answer: A, B

   Microsoft Defender for Endpoint provides device response actions including running an antivirus scan, collecting an investigation package (forensic data), isolating the device, and restricting app execution. Running a scan and collecting an investigation package are both valid response actions available for onboarded devices.

   Why the other options are wrong

   • CBitLocker recovery key rotation is performed from Intune or Entra ID, not as a Defender for Endpoint response action.
   • DChanging the Entra join type is a device identity/enrollment operation and is not a Defender response action.
10. Question 10Optimize endpoint operations by using automation, monitoring, and reporting

    A manager asks for a report that can be shared with auditors showing the compliance state of devices as of a specific point in time, exported to a file. Which combination correctly describes how to satisfy this in Microsoft Intune?

    • AGenerate the Device compliance report and export it to CSVCorrect
    • BChange the compliance policy grace period and screenshot the result
    • CWipe noncompliant devices and share the confirmation email
    • DEnable tenant attach and export a Configuration Manager collection list
    ✓ Correct answer: A

    Intune's Device compliance report captures compliance state, and the reporting export API delivers that data as a downloadable CSV file suitable for sharing with auditors. This provides an accurate, file-based record without manual copying.

    Why the other options are wrong

    • BChanging a grace period alters policy behavior and a screenshot is not an auditable, machine-readable export.
    • CWiping devices is destructive and does not produce a compliance report for auditors.
    • DA Configuration Manager collection list exported through tenant attach is membership data, not Intune compliance state.

Who this MD-102 practice exam is for

This practice set is for anyone preparing for the MD-102: Microsoft Endpoint Administrator exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this MD-102 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real MD-102 exam.

Related Microsoft resources

• MD-102 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• MS-700 practice examRelated
• MS-721 practice examRelated
• PL-300 practice examRelated

MD-102 practice exam FAQ