MD-102: Microsoft Endpoint Administrator Practice Exam

What the MD-102 exam covers

• Prepare infrastructure for devices172 questions
• Manage and maintain devices196 questions
• Protect devices128 questions
• Manage and secure applications136 questions
• Optimize endpoint operations by using automation, monitoring, and reporting95 questions

Free MD-102 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 727.

1. Question 1Manage and maintain devices

   Your organization plans to deploy Windows 11 to 500 new devices using Windows Autopilot. You need to ensure that devices are automatically enrolled in Microsoft Intune during the out-of-box experience (OOBE). What must you do first?

   • AInstall the Microsoft Intune Company Portal app on each device
   • BCreate a Group Policy Object (GPO) that enables automatic MDM enrollment
   • CRegister the hardware hashes of the devices in Windows AutopilotCorrect
   • DCreate a provisioning package using Windows Configuration Designer
   ✓ Correct answer: C

   Windows Autopilot requires devices to be registered by their hardware hashes in the Autopilot service before deployment. The hardware hash is a unique identifier that associates the physical device with your tenant and enables Autopilot to recognize and provision the device automatically during OOBE. Registration with hardware hashes is the foundational step that must be completed before any other Autopilot configuration takes effect.

   Why the other options are wrong

   • AInstall the Microsoft Intune Company Portal app on each device is incorrect because the Company Portal is installed automatically during enrollment as part of the OOBE process, not as a prerequisite.
   • BCreate a Group Policy Object (GPO) that enables automatic MDM enrollment is incorrect because GPOs apply only to on-premises domain-joined devices and are not part of the Autopilot registration process.
   • DCreate a provisioning package using Windows Configuration Designer is incorrect because provisioning packages are optional tools that can supplement Autopilot deployment but are not required for basic hardware registration.
2. Question 2Manage and maintain devices

   You need to migrate user profiles from Windows 10 devices to new Windows 11 devices. Which tool should you use to capture and restore user state data?

   • Arobocopy with /MIR switch
   • BOneDrive Known Folder Move
   • CUser State Migration Tool (USMT)Correct
   • DWindows Easy Transfer
   ✓ Correct answer: C

   USMT is the enterprise-standard solution for capturing user profiles and migrating them to new Windows 11 devices during device refreshes. It captures registry hives, documents, application settings, user folders, and other profile data from Windows 10 devices, then restores them on Windows 11 devices while maintaining security and application compatibility. USMT handles complex profile migrations that manual file copying cannot address, including application-specific settings and Windows Registry data.

   Why the other options are wrong

   • Arobocopy with /MIR switch is incorrect because while it copies files efficiently, it does not capture registry settings, user profiles, or application-specific configurations required for complete user state migration.
   • BOneDrive Known Folder Move is incorrect because it manages cloud synchronization of user folders but does not capture local application settings or complete user profile data.
   • DWindows Easy Transfer is incorrect because this legacy tool was discontinued in Windows 10 and is not supported for Windows 11 migrations.
3. Question 3Prepare infrastructure for devicesSelect all that apply

   Consolidated Messenger is implementing Windows Hello for Business. Which THREE authentication methods does Windows Hello for Business support?

   • AFingerprint recognitionCorrect
   • BSMS-based one-time passcode
   • CFacial recognitionCorrect
   • DSmart card with password
   • EPINCorrect
   ✓ Correct answer: A, C, E

   Windows Hello for Business supports three primary biometric and credential-based authentication methods. Fingerprint recognition uses the device's fingerprint sensor for authentication. Facial recognition uses facial recognition cameras to authenticate the user. PIN is a traditional numerical code used for authentication when biometric methods are unavailable or disabled. These three methods collectively provide flexible authentication options while maintaining strong security for device access.

   Why the other options are wrong

   • BSMS-based one-time passcode is incorrect because SMS-based authentication is not supported by Windows Hello for Business; Windows Hello uses local biometric and PIN methods only.
   • DSmart card with password is incorrect because smart cards are a separate authentication mechanism and are not integrated into Windows Hello for Business's biometric authentication framework.
4. Question 4Protect devices

   What is the purpose of security baselines in Microsoft Intune?

   • APrebuilt Microsoft-recommended settings for Windows, Edge, and Defender that admins can customizeCorrect
   • BFixed configuration templates that cannot be modified once assigned to a device group
   • CConfiguration profiles that apply only to Microsoft Edge, with no Windows OS coverage
   • DEndpoint policies that directly block non-compliant devices from corporate resources
   ✓ Correct answer: A

   Intune provides prebuilt security baselines, groups of Microsoft-recommended settings for hardening devices, including the Windows baseline, the Microsoft Defender for Endpoint baseline, and the Microsoft Edge baseline. Administrators deploy a baseline to assigned groups, can customize individual settings or version the profile, and Intune reports on how devices match it. Baselines accelerate secure configuration by applying Microsoft's recommended defaults instead of building every policy from scratch.

   Why the other options are wrong

   • BBaseline settings can be customized before or after assignment; they are not locked templates.
   • CBaselines cover multiple areas including the Windows OS and Defender for Endpoint, not just Microsoft Edge.
   • DBaselines report device configuration drift; enforcing access based on that state still requires Conditional Access.
5. Question 5Protect devicesSelect all that apply

   An organization wants to configure Windows Update for Business deployment rings in Microsoft Intune for their Windows 11 devices. The administrator needs to defer quality updates by 7 days and feature updates by 30 days for the production ring. Which two settings should the administrator configure in the update ring profile? (Choose two.)

   • AQuality update deferral period set to 7 daysCorrect
   • BUninstall window for feature updates set to 30 days
   • CAutomatic update behavior set to Auto install and restart at maintenance time
   • DFeature update deferral period set to 30 daysCorrect
   • EDelivery optimization mode set to HTTP blended with peering behind same NAT
   ✓ Correct answer: A, D

   Windows Update for Business deployment rings require separate deferral settings for two types of updates: quality updates (security and servicing patches) and feature updates (major OS version updates). The Quality update deferral period controls when quality updates are deployed, while the Feature update deferral period controls when feature updates are deployed. Configuring these two settings independently allows organizations to apply different update cadences for different update types.

   Why the other options are wrong

   • BUninstall window for feature updates set to 30 days is incorrect because the uninstall window defines how long users can uninstall an update after installation, not the deferral period.
   • CAutomatic update behavior set to Auto install and restart at maintenance time is incorrect because this setting controls restart behavior, not deferral periods.
   • EDelivery optimization mode set to HTTP blended with peering behind same NAT is incorrect because delivery optimization controls bandwidth management, not update deferral timing.
6. Question 6Manage and secure applications

   A company has a custom line-of-business Windows application packaged as an .intunewin file. The application requires a prerequisite .NET Framework version and a specific registry key to be present before installation. Where should the administrator define these requirements in Intune?

   • AIn the requirements section using custom requirement rulesCorrect
   • BIn the app dependencies section
   • CIn the app supersedence section
   • DIn the detection rules section of the Win32 app configuration
   ✓ Correct answer: A

   Intune's Win32 app requirements section allows administrators to define prerequisites that must be met before an application can be installed on a device. Custom requirement rules can check for specific conditions like .NET Framework versions, registry keys, file existence, and other system prerequisites. Intune evaluates these requirements before attempting installation and ensures the device meets all prerequisites before proceeding.

   Why the other options are wrong

   • BIn the app dependencies section is incorrect because dependencies link one app to another app, not to system-level prerequisites like .NET Framework.
   • CIn the app supersedence section is incorrect because supersedence is used to manage version upgrades of the same application, not prerequisites.
   • DIn the detection rules section of the Win32 app configuration is incorrect because detection rules verify installation success, not prerequisites for installation.
7. Question 7Manage and maintain devices

   In a Microsoft Deployment Toolkit (MDT) Lite Touch deployment, what is the primary role of the Windows Preinstallation Environment (Windows PE) boot image?

   • AIt hosts the deployment share and stores all of the operating system images, drivers, and task sequences for the whole deployment environment
   • BIt provides a minimal pre-boot operating system that starts the client, connects to the deployment share, and launches the task sequenceCorrect
   • CIt permanently replaces the production Windows image on the disk once the deployment task sequence has finished running fully
   • DIt manages device licensing and product activation for each client by contacting the Volume Activation Management Tool server
   ✓ Correct answer: B

   MDT Lite Touch Installation depends on a Windows PE boot image (a WIM that can be booted from media, USB, or PXE/WDS). When a target machine boots into Windows PE it loads a minimal operating system with networking and scripting support, connects to the MDT deployment share, and starts the Lite Touch task sequence that partitions the disk, applies the OS image, installs drivers and apps, and completes configuration. Without Windows PE there is no environment in which to launch the deployment, so it is a genuine dependency.

   Why the other options are wrong

   • AThe deployment share is hosted on the MDT server, not provided by the Windows PE boot image that clients start into.
   • CWindows PE is a temporary staging environment; the applied production image, not PE, remains after the task sequence.
   • DWindows PE does not handle activation; VAMT and KMS manage licensing separately from the boot image.
8. Question 8Manage and secure applicationsSelect all that apply

   An administrator at Adatum Corporation is planning to use app configuration policies. Which two of the following are requirements or features of this solution? (Choose two.)

   • AWin32 app deploymentCorrect
   • BApp supersedence
   • CPolicies configuration app
   • DLOB app deploymentCorrect
   • EApple App Store apps
   ✓ Correct answer: A, D

   App configuration policies in Intune allow administrators to inject settings into applications at deployment time without requiring manual user configuration or application re-packaging. Win32 apps are traditional Windows desktop applications that require deployment and configuration management to ensure compatibility, proper installation, and consistent settings across managed devices. Line of business (LOB) apps are custom organizational applications that require specialized configuration to integrate with enterprise systems, authentication methods, and data sources. Both Win32 and LOB apps benefit from app configuration policies to automate settings deployment and reduce configuration errors and support burden.

   Why the other options are wrong

   • Bapp supersedence is incorrect because supersedence is an application versioning and automatic upgrade mechanism, not a core requirement of app configuration policies.
   • Cpolicies configuration app is incorrect because this is invalid terminology; app configuration policies is the correct naming convention.
   • EApple App Store apps is incorrect because while Apple App Store apps can be managed, they are iOS-focused applications not typically requiring the same configuration policy management as Win32 or LOB desktop apps.
9. Question 9Protect devices

   You configure web content filtering in Microsoft Defender for Endpoint to block access to gambling and adult-content websites on managed Windows 11 devices. Which prerequisite must be enabled for web content filtering to take effect?

   • ABitLocker on the system drive
   • BNetwork protection in block modeCorrect
   • CControlled folder access
   • DWindows Hello for Business
   ✓ Correct answer: B

   Web content filtering categorizes sites and blocks unwanted categories, but enforcement depends on Defender's network protection feature operating in block (not audit) mode on the device. Without network protection enabled, the filtering policies are not enforced.

   Why the other options are wrong

   • ABitLocker encrypts data at rest and is unrelated to web category filtering.
   • CControlled folder access protects files from ransomware, not web access.
   • DWindows Hello for Business handles authentication and has no role in web content filtering enforcement.
10. Question 10Optimize endpoint operations by using automation, monitoring, and reporting

    You need very large raw data sets, such as a complete list of all managed devices with detailed properties, primarily so you can export them programmatically for offline processing. Which Intune report category is optimized for this scenario?

    • ASpecialty reportsCorrect
    • BOperational reports
    • CHistorical reports
    • DOrganizational summary tiles
    ✓ Correct answer: A

    Specialty reports in Intune are built to return large volumes of raw records and are primarily consumed through the export API rather than being browsed interactively in the portal. They suit programmatic export and offline processing of detailed device data.

    Why the other options are wrong

    • BOperational reports are small, timely, filtered views for immediate action, not large raw exports.
    • CHistorical reports emphasize trends over time rather than bulk raw record export.
    • DOrganizational summary tiles present aggregated dashboards, not large raw data sets for programmatic export.

Who this MD-102 practice exam is for

This practice set is for anyone preparing for the MD-102: Microsoft Endpoint Administrator exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this MD-102 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real MD-102 exam.

Related Microsoft resources

• MD-102 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• MS-700 practice examRelated
• MS-721 practice examRelated
• PL-300 practice examRelated

MD-102 practice exam FAQ