Crucial Exams
00:20:00

Microsoft 365 Endpoint Administrator Associate Practice Test (MD-102)

Use the form below to configure your Microsoft 365 Endpoint Administrator Associate Practice Test (MD-102). The practice test can be configured to only include certain exam objectives and domains. You can choose between 5-100 questions and set a time limit.

Logo for Microsoft 365 Endpoint Administrator Associate MD-102
Questions
Number of questions in the practice test
Free users are limited to 20 questions, upgrade to unlimited
Seconds Per Question
Determines how long you have to finish the practice test
Exam Objectives
Which exam objectives should be included in the practice test

Microsoft 365 Endpoint Administrator Associate MD-102 Information

The Endpoint Administrator Associate Exam (MD-102)

The Microsoft 365 Endpoint Administrator Associate certification, obtained by passing the MD-102 exam, validates the skills required for deploying, configuring, protecting, managing, and monitoring devices and client applications in a Microsoft 365 environment. This certification has replaced the previous MD-100 and MD-101 exams, unifying the content into a single, comprehensive test that reflects the shift towards cloud-centric and hybrid endpoint management. The exam is intended for IT professionals, including system administrators and endpoint managers, who are responsible for managing identity, security, access, policies, updates, and apps for endpoints. Candidates should have subject matter expertise in Microsoft Intune, Windows 365, Windows Autopilot, Microsoft Defender for Endpoint, and Microsoft Entra ID.

The skills measured in the MD-102 exam are grouped into several key areas. A significant portion of the exam focuses on managing, maintaining, and protecting devices, which can account for 40-45% of the questions. Another major domain is the deployment of Windows clients, making up about 25-30% of the content. The remaining sections cover managing identity and compliance (15-20%) and managing applications (15-20%). This structure emphasizes the modern administrator's role in not just deploying operating systems but also ensuring that devices remain secure and compliant throughout their lifecycle using tools like Microsoft Intune.

The Value of Practice Exams for Success

To successfully pass the MD-102 exam, hands-on experience should be supplemented with thorough preparation, and practice exams are an invaluable tool in this process. Taking practice tests helps candidates assess their knowledge, identify areas of weakness, and become familiar with the format and types of questions they will encounter in the actual exam, which can include multiple-choice and scenario-based questions. These practice runs provide a realistic testing experience, allowing you to gauge your readiness and build confidence.

Many resources offer practice exams that cover all the domains of the official MD-102 syllabus and provide detailed explanations for both correct and incorrect answers. This feedback is crucial for understanding the underlying concepts and learning from mistakes. By simulating the exam environment, candidates can practice time management and reduce anxiety, which are key factors for success on exam day. Utilizing these tools allows you to focus your study efforts more effectively on the topics that require further attention, ultimately increasing your chances of earning the Microsoft 365 Certified: Endpoint Administrator Associate certification.

Follow us on...
Microsoft 365 Endpoint Administrator Associate MD-102 Logo

  • Free Microsoft 365 Endpoint Administrator Associate MD-102 Practice Test

  • 20 Questions
  • Unlimited
  • Prepare infrastructure for devices
    Manage and maintain devices
    Manage applications
    Protect devices
Question 1 of 20

You will deploy 500 new Windows 11 laptops by using Windows Autopilot. Each computer is shipped directly from the OEM to employees working from home. During the first-run experience, users must enter only their corporate email address and password. The devices must automatically join Azure Active Directory, enroll in Microsoft Intune, and must not grant users local administrator rights. Which Autopilot deployment mode should you configure in the deployment profile to meet these requirements?

  • Pre-provisioning (formerly white-glove)

  • Self-deploying mode

  • User-driven mode (Azure AD join)

  • Autopilot for existing devices

Question 2 of 20

Users in the AAD-Joiners security group attempt to join their personal Windows computers to Microsoft Entra ID from Settings > Accounts > Access work or school > Connect, but on some machines the Join this device to Azure Active Directory option is missing. You must identify why and make the option appear. Which requirement must those computers meet?

  • They must already be enrolled in Microsoft Intune.

  • They must be connected to the corporate network through a VPN tunnel.

  • They must have TPM 2.0 enabled and BitLocker drive encryption turned on.

  • They must be running Windows 10/11 Pro, Enterprise, or Education editions instead of Windows Home.

Question 3 of 20

A user emailed their BitLocker recovery key for a corporate Windows 11 laptop to an external recipient. You open the device record in Microsoft Intune and select the Rotate BitLocker keys remote action. After the action successfully completes, which outcome should you expect on the device?

  • BitLocker protection is suspended and then resumed, continuing to use the original recovery password.

  • The existing recovery password is pushed again to Azure AD and marked as the active key without changing it on the device.

  • The entire volume is decrypted and then re-encrypted to generate a new full-volume encryption key.

  • The device creates a new BitLocker recovery password, uploads it to Intune, and invalidates the previously stored password.

Question 4 of 20

Contoso plans to deploy Microsoft Intune for Windows 11 devices. The administrators must ensure that only members of a Microsoft Entra security group named Corporate Users can automatically enroll their Azure AD-joined devices into Intune. All other users must be prevented from enrollment. In the Microsoft Intune admin center, which enrollment setting should you configure?

  • Reduce the per-user device limit to 0 for all users except the Corporate Users group.

  • Set the MDM user scope to Some and assign the Corporate Users group.

  • Create a Windows enrollment device platform restriction that blocks personal devices for all other users.

  • Set the MAM user scope to Some and assign the Corporate Users group.

Question 5 of 20

You open the Device queries (preview) pane in Intune and need to return every Windows client whose build number is 22621 or later (Windows 11 22H2 or newer). Which KQL statement accomplishes this goal without including older Windows 11 or Windows 10 builds?

  • DeviceInfo | where operatingSystem == "Windows" | where toint(split(osBuildVersion, ".")) >= 22621 | project deviceName, osBuildVersion

  • DeviceInfo | where operatingSystem == "Windows" | extend build = toint(split(osBuildVersion, ".")) | where build >= 22621 | project deviceName, osBuildVersion

  • DeviceInfo | where operatingSystem contains "Windows 11" | where osBuildVersion >= "22621" | project deviceName, osBuildVersion

  • DeviceInfo | where osBuildVersion > "22620" | project deviceName, osBuildVersion

Question 6 of 20

You plan to roll out 500 corporate-owned Windows 11 Enterprise laptops. Company policy requires that the operating system volume is automatically encrypted with BitLocker during Autopilot enrollment, that recovery keys are stored in Azure AD, and that users cannot disable BitLocker. In Microsoft Intune, which type of policy should you create to meet these requirements while adhering to Microsoft best practice?

  • Create a Device configuration profile that uses the Identity protection template.

  • Create an Endpoint security Antivirus policy and enable drive encryption settings.

  • Create a Device compliance policy that marks devices noncompliant if BitLocker is disabled.

  • Create an Endpoint security Disk encryption policy that uses the Windows 10 and later BitLocker profile.

Question 7 of 20

You have assigned several Windows 11 update rings in Microsoft Intune. After the first deployment cycle, you need to determine which devices still require a restart to finish installing the latest quality updates. In the Intune admin center, which built-in report should you review to locate those devices without running additional filters or exporting data?

  • Windows update ring device status

  • Windows expedited update status

  • Windows feature update deployment status

  • Update compliance workbook in Azure Monitor

Question 8 of 20

Your company purchased 200 Android tablets that will be permanently mounted in meeting rooms to display a room-scheduling application. Users must be prevented from accessing system settings or adding personal Google accounts. You will enroll the tablets in Microsoft Intune by providing an enrollment token (for example, by scanning a QR code) during initial device setup after a factory reset. Which Android Enterprise enrollment profile should you configure to meet the requirements?

  • Android Enterprise personally-owned work profile enrollment profile

  • Android Enterprise dedicated device enrollment profile

  • Android Enterprise corporate-owned work profile enrollment profile

  • Android Enterprise fully managed device enrollment profile

Question 9 of 20

Your company has a folder named C:\Packages\FinanceApp that contains FinanceAppSetup.exe and several required DLL files. You need to deploy the application to Windows 10 and Windows 11 devices as a Win32 app by using Microsoft Intune. Before you upload the app in the Intune admin center, which action should you perform on the folder, and what output file will be produced?

  • Compress the folder into a .zip file and upload the archive directly to Intune.

  • Use the Office Deployment Tool to convert the executable and create a .cab package.

  • Package the installer with the App-V Sequencer to produce a .appv file.

  • Run IntuneWinAppUtil.exe against the folder to generate a FinanceAppSetup.intunewin file.

Question 10 of 20

Your company uses Microsoft Intune as the MDM authority and has Microsoft Entra ID Premium P1 licenses. All Windows 11 laptops are already joined to Microsoft Entra ID. You need to ensure that devices automatically enroll in Intune when users sign in, but only for users who are members of the Sales Azure AD group. What should you configure?

  • Set the MDM user scope to Some and assign the Sales Azure AD group.

  • Remove Intune licenses from all users except those in the Sales group.

  • Create a Conditional Access policy that requires compliant devices for the Sales group.

  • Create a device configuration profile for Windows and target it to the Sales group.

Question 11 of 20

You administer Microsoft Intune for Contoso. A corporate-owned Windows 11 laptop has been permanently lost. You must immediately remove all Intune-managed apps, configuration profiles, and company data from the device so that it can no longer access organizational resources. Local user data on the device must remain intact. Which Intune remote action should you perform?

  • Delete

  • Retire

  • Wipe

  • Fresh Start

Question 12 of 20

You manage 5,000 Windows 10 devices that run Microsoft 365 Apps for enterprise. You need an automated way to ensure a pilot group of 200 devices always receives the newest Monthly Enterprise Channel build promptly after Microsoft releases it, and you must be able to roll back those devices to the previous build if problems occur. Which feature in the Microsoft 365 Apps admin center should you use?

  • Enable ProPlus Delivery Optimization for the tenant in the Microsoft 365 admin center.

  • Configure a Windows Update for Business ring that forces updates every two days.

  • Define a macro security policy in the Office cloud policy service for the pilot group.

  • Create a servicing profile and assign the pilot devices to it.

Question 13 of 20

You are creating an Endpoint security Attack surface reduction rules profile in Microsoft Intune for Windows 11 devices. The rule "Block Office applications from creating child processes" must remain in Block mode. However, an internally developed tool named ContosoApp.exe has to keep launching child processes from Microsoft Word, no matter where ContosoApp.exe is located on disk. You plan to use the rule's exclusion list. Which single value should you add to the exclusion list to meet the requirement?

  • ContosoApp.exe

  • The SHA-256 hash of ContosoApp.exe

  • The code-signing certificate thumbprint used to sign ContosoApp.exe

  • The folder path where ContosoApp.exe is currently stored

Question 14 of 20

A company-owned Windows 11 laptop must be prepared for reassignment to a new employee. The device should be reset to factory defaults and all data from the previous user must be removed. However, the laptop must remain Azure AD-joined and stay enrolled in Microsoft Intune so that it continues to receive policies without requiring Windows Autopilot provisioning again. In the Microsoft Intune admin center, which remote action meets these requirements?

  • Autopilot Reset

  • Fresh Start

  • Wipe device, but keep enrollment state and associated user account

  • Retire

Question 15 of 20

You need to create a dynamic Microsoft Entra ID device group that will contain only the Windows computers that are hybrid Azure AD-joined. Which device attribute should you use in the membership rule to accurately target these devices?

  • deviceTrustType equals "ServerAd"

  • deviceEnrollmentType equals "WindowsAutopilot"

  • joinType equals "AAD"

  • deviceOwnership equals "Company"

Question 16 of 20

You need to retrieve each enrolled Windows 11 device's BIOS serial number by using the Device query (preview) remote action in Microsoft Intune instead of running a custom script. Which Kusto Query Language statement should you run so that every device returns only its own BIOS serial number?

  • Registry | where Key == "HKLM\HARDWARE\DESCRIPTION\System" | project DeviceName, Value

  • DeviceSystemInfo | project BiosSerialNumber

  • Bios | summarize arg_max(TimeGenerated, *) by DeviceName

  • Bios | project SerialNumber

Question 17 of 20

You are preparing a Windows Autopilot user-driven deployment for 1,000 remote employees. Company policy states that users must be blocked from accessing the Windows desktop until every required Win32 application, baseline policy, and compliance policy is fully installed or applied. The solution must also display real-time provisioning progress to the user during the first run experience. Which Intune feature should you configure to meet these requirements?

  • Deploy the security baseline as a device configuration profile with the Highest priority.

  • Enable Windows Autopilot pre-provisioning (White Glove) on the deployment profile.

  • Create and assign an Enrollment Status Page profile that blocks device use until provisioning is complete.

  • Set a 0-hour installation deadline on all required Win32 applications.

Question 18 of 20

You manage devices with Microsoft Intune. You need to rotate the BitLocker recovery keys for 90 Windows 11 laptops at the same time. In the Microsoft Intune admin center, which navigation path should you use to launch the bulk action that lets you perform this task in a single operation?

  • Devices > Bulk device actions, choose Windows, and then select Rotate BitLocker key.

  • Devices > Configuration profiles, deploy a PowerShell script that rotates the keys.

  • Devices > All devices > Bulk device actions, choose Windows, and then select Rotate BitLocker key.

  • Endpoint security > Disk encryption, open the BitLocker policy, and start a key rotation task.

Question 19 of 20

You deploy Endpoint Privilege Management (EPM) and assign a settings policy to a group of Windows 11 devices. Help-desk staff ask that a line-of-business executable (C:\Apps\AcmeTool.exe) can be run with elevated rights by standard users for up to two hours, without requiring service-desk approval. What should you configure next in Microsoft Intune to meet the requirement?

  • Deploy the Windows security baseline and enable the policy setting 'Enable LAPS and Local Admin Password Rotation'.

  • Create an Endpoint Privilege Management Elevation rules policy, add an Automatic rule for C:\Apps\AcmeTool.exe, and set the maximum elevation duration to 120 minutes.

  • Assign the built-in Help Desk Operator Intune role to the users for two hours by using a Privileged Identity Management (PIM) activation.

  • Create a second Endpoint Privilege Management settings policy that enables User confirmed elevations and assign it to the same device group.

Question 20 of 20

Your organization manages supervised corporate-owned iPhones with Microsoft Intune. Administrators must hide new iOS versions from users for 30 days after Apple releases them. After the 30-day period, an existing update policy will install the update automatically. Which Intune profile type contains the setting you must configure to meet this requirement?

  • Create an iOS/iPadOS compliance policy that requires devices to run an OS version at least 30 days old.

  • Create and assign an iOS/iPadOS Device Restrictions profile that sets Delay visibility of software updates to 30 days.

  • Create a custom configuration profile that uses the com.apple.SoftwareUpdate payload to postpone updates for 30 days.

  • Create and deploy an iOS/iPadOS update policy profile that defers updates for 30 days.