10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
These 10 free MD-102 questions are organized by exam domain, so you can see how each part of the Microsoft 365 Certified: Endpoint Administrator Associate blueprint is tested. Reveal the answer and explanation under each question.
Contoso assigns a device compliance policy that requires BitLocker encryption to all Windows devices. No other policies exist in the tenant. Several laptops are reported as Not compliant in the Microsoft Intune admin center, but their users can still open corporate email and files. What must you configure to block these devices from accessing company resources?
Correct answer: C - A Conditional Access policy that requires devices to be marked as compliant
Fabrikam has an on-premises Active Directory domain and a line-of-business application that authenticates users by using Kerberos. The company is deploying new Windows 11 laptops that must run this application and be managed by Microsoft Intune. Which device join type meets the requirements?
Correct answer: B - Microsoft Entra hybrid joined
An organization manages 400 corporate iPhones with Microsoft Intune. On Monday morning, every iOS device stops responding to management commands and no new iOS devices can enroll. Windows and Android devices are unaffected. What is the most likely cause?
Correct answer: A - The Apple Push Notification service certificate has expired
A device compliance policy must give users five days to remediate a failed check before their device is treated as noncompliant. Which setting do you configure?
Correct answer: D - Set the schedule for the Mark device noncompliant action to 5 days
You create a Windows Autopilot deployment profile that uses self-deploying mode and assign it to a group of virtual machines used for testing. Provisioning fails on every virtual machine, while physical laptops assigned the same profile complete successfully. What is the cause?
Correct answer: D - Self-deploying mode requires TPM 2.0 and device attestation
Two device configuration profiles are assigned to the same Windows 11 device. One profile sets the minimum PIN length to 6 and the other sets the minimum PIN length to 8. What is the result on the device?
Correct answer: D - Neither value is applied and the setting reports a conflict
A Windows 11 laptop is returned when an employee leaves and must be issued to a new employee. All previous user data, apps, and settings must be removed, but the device must remain Microsoft Entra joined and enrolled in Intune so that it is ready for the next user. Which remote action should you use?
Correct answer: C - Autopilot Reset
A supplier ships 300 Windows 11 laptops directly to remote employees. Hardware hashes were never collected and the supplier cannot register the devices. The laptops must be Microsoft Entra joined and provisioned when the employee signs in for the first time. What should you implement?
Correct answer: C - A Windows Autopilot device preparation policy
Before enforcing a new attack surface reduction rule across 4,000 devices, you must measure how many business applications the rule would block. No application may be prevented from running and no user may be interrupted during the evaluation. How should you configure the rule?
Correct answer: D - Set the rule to Audit
A Win32 app installs successfully on a test device and the application launches normally, but the Microsoft Intune admin center continues to report the installation as failed. What is the most likely cause?
Correct answer: B - The detection rule does not match the installed state of the application
The MD-102 exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more MD-102 questions with explanations.
Continue in the free practice test →
View plans