Preview real exam-style questions before you buy—see exactly what you're getting.
Free sample questions with detailed explanations • No signup required.
The MD-102: Endpoint Administrator Associate certification exam is designed for IT professionals who want to demonstrate their skills in managing modern endpoints and devices within a Microsoft 365 environment. As organizations increasingly adopt cloud-first strategies, the ability to efficiently deploy, configure, secure, and monitor devices is critical to maintaining a robust IT infrastructure.
What Is the MD-102 Certification Exam?
This certification validates your expertise in managing devices running Windows 10 and Windows 11, leveraging Microsoft Intune, Windows Autopilot, and Endpoint Manager. It covers essential skills such as enrolling devices, implementing policies, managing apps, and securing data. Passing the MD-102 exam proves you have the practical knowledge needed to support end-users, maintain device compliance, and optimize endpoint configurations in a real-world business setting.
What Will You Learn?
By preparing for the MD-102 exam, you’ll gain comprehensive knowledge of:
Windows Enrollment and Deployment: Learn how to deploy Windows devices using modern methods like Windows Autopilot and manage hybrid Azure AD join scenarios.
Device and Profile Management: Understand how to configure device profiles, restrictions, and compliance policies to ensure organizational security requirements are met.
Application Management: Master deploying, updating, and managing apps across devices using Microsoft Intune and the Microsoft Store for Business.
Endpoint Security: Explore techniques to protect devices with BitLocker encryption, Windows Defender, and Application Control policies.
Monitoring and Troubleshooting: Develop skills to monitor device health, deploy update rings, and troubleshoot common issues affecting endpoint performance.
Key Topics Covered
The MD-102 exam covers a broad range of topics critical for Endpoint Administrators, including:
Windows Autopilot deployment and configuration
Device enrollment options (Azure AD Join, Hybrid Join)
Intune device configuration profiles and compliance policies
Application lifecycle management with Intune
Endpoint security management (BitLocker, Windows Defender, WDAC)
Windows Update management and update rings
Conditional Access and device compliance integration with Azure AD
Device and user monitoring with Microsoft Endpoint Manager
Troubleshooting device and enrollment issues
Why Choose Our MD-102 Practice Exam?
Our MD-102 practice tests are carefully crafted by experts who understand the exam objectives and current industry practices. Each question is designed to mirror the real exam format, complete with detailed explanations that help you understand the reasoning behind each answer.
Preparing with PrepPool means:
Access to high-quality, realistic practice questions
Comprehensive answer explanations for deeper understanding
Regular updates aligned with Microsoft exam changes
A focused approach to mastering key concepts without distractions
Start Your Journey to Becoming a Certified Endpoint Administrator
Whether you’re new to endpoint management or looking to validate your skills, the MD-102 certification opens doors to career growth in IT administration and device management roles. With www.preppool.com’s expert practice tests, you can approach your exam confidently, knowing you’ve thoroughly prepared.
Sample Questions and Answers
1. What is the primary function of Microsoft Endpoint Manager?
A) Manage Azure Active Directory user accounts
B) Manage devices and applications across an organization
C) Create virtual machines in Azure
D) Manage Office 365 licenses
Answer: B) Manage devices and applications across an organization
Explanation: Microsoft Endpoint Manager is a unified platform that combines Configuration Manager and Intune to manage devices (PCs, mobile, etc.) and applications across an enterprise.
2. Which protocol does Windows Autopilot primarily use to provision new devices?
A) DHCP
B) PXE Boot
C) HTTPS
D) SMB
Answer: C) HTTPS
Explanation: Windows Autopilot uses HTTPS to securely communicate with Microsoft services during device provisioning and configuration.
3. Which of the following is NOT a feature of Microsoft Intune?
A) Mobile device management
B) Application deployment
C) Antivirus management
D) Conditional access policies
Answer: C) Antivirus management
Explanation: While Intune can integrate with antivirus solutions, it does not manage antivirus directly; endpoint protection is handled separately via Windows Defender or third-party tools.
4. What is the default device enrollment type in Microsoft Intune for Windows 10/11 devices?
A) Apple DEP
B) Windows Autopilot
C) Windows Enrollment (Automatic Enrollment)
D) Bulk enrollment with CSV file
Answer: C) Windows Enrollment (Automatic Enrollment)
Explanation: For devices joined to Azure AD, automatic enrollment is the default method for Intune management.
5. In Endpoint Manager, what is the primary purpose of Compliance Policies?
A) To ensure devices have necessary applications installed
B) To enforce security settings and ensure devices meet organizational standards
C) To configure VPN profiles
D) To manage user licenses
Answer: B) To enforce security settings and ensure devices meet organizational standards
Explanation: Compliance policies define rules and settings that devices must meet to be considered compliant.
6. What is the function of a Configuration Profile in Microsoft Intune?
A) Assign licenses to users
B) Deploy applications
C) Configure device settings such as Wi-Fi, VPN, or restrictions
D) Monitor network traffic
Answer: C) Configure device settings such as Wi-Fi, VPN, or restrictions
Explanation: Configuration profiles are used to configure and enforce device-specific settings.
7. What kind of management is available for non-Windows devices in Microsoft Endpoint Manager?
A) Only mobile device management (MDM)
B) Only mobile application management (MAM) without device enrollment
C) Both MDM and MAM
D) None of the above
Answer: C) Both MDM and MAM
Explanation: Intune supports both full device management (MDM) and app-level management (MAM) for iOS, Android, and macOS devices.
8. Which Azure AD join option supports users signing in with their Azure AD credentials and automatic device enrollment to Intune?
A) Hybrid Azure AD join
B) Azure AD join
C) Workgroup join
D) Local domain join
Answer: B) Azure AD join
Explanation: Azure AD join allows users to sign in with Azure AD credentials and supports automatic device enrollment in Intune.
9. What is the benefit of co-management in Microsoft Endpoint Manager?
A) It allows simultaneous management of devices by Configuration Manager and Intune
B) It supports only cloud-based management
C) It is required for macOS management
D) It disables Configuration Manager when enabled
Answer: A) It allows simultaneous management of devices by Configuration Manager and Intune
Explanation: Co-management lets you manage Windows 10/11 devices with both Configuration Manager and Intune.
10. What is a Win32 app in Microsoft Intune?
A) A type of mobile application only
B) Traditional desktop applications packaged for deployment in Intune
C) An app available only in the Microsoft Store
D) An app that runs exclusively on Windows Server
Answer: B) Traditional desktop applications packaged for deployment in Intune
Explanation: Win32 apps are classic desktop applications that are wrapped and deployed via Intune.
11. Which Windows feature can be used to restrict users from installing apps outside of the Microsoft Store?
A) AppLocker
B) Device Guard
C) Windows Defender
D) Windows Information Protection
Answer: A) AppLocker
Explanation: AppLocker allows administrators to create policies restricting which apps and files users can run.
12. In Intune, what is the purpose of Conditional Access policies?
A) To assign device licenses
B) To control access to cloud apps based on device compliance and user location
C) To install software updates automatically
D) To monitor device health status
Answer: B) To control access to cloud apps based on device compliance and user location
Explanation: Conditional Access policies enforce controls like requiring compliant devices or MFA before access is granted.
13. What method can be used to remotely wipe a lost or stolen Windows device managed by Intune?
A) Use the Azure portal to trigger a selective wipe or full wipe
B) Only a full system reinstall works
C) Remote desktop into the device and delete files manually
D) Wait for the device to expire automatically
Answer: A) Use the Azure portal to trigger a selective wipe or full wipe
Explanation: Intune allows admins to remotely wipe devices or selectively wipe corporate data.
14. Which of the following is a primary benefit of Windows Autopilot?
A) Automatically creates Active Directory user accounts
B) Automates the initial device setup and configuration with minimal IT intervention
C) Provides antivirus protection for new devices
D) Automatically updates Microsoft Office apps
Answer: B) Automates the initial device setup and configuration with minimal IT intervention
Explanation: Windows Autopilot enables IT to ship devices directly to users pre-configured via cloud profiles.
15. How does Intune deliver software updates to managed Windows devices?
A) Via Windows Update for Business policies
B) By manually pushing updates through Configuration Manager only
C) Using Azure AD group policies
D) Through VPN connections only
Answer: A) Via Windows Update for Business policies
Explanation: Intune leverages Windows Update for Business to manage feature and quality updates.
16. What does Azure AD Hybrid Join mean for devices?
A) Devices are joined only to local AD with no cloud connection
B) Devices are joined to both on-premises AD and registered with Azure AD
C) Devices are only joined to Azure AD
D) Devices are managed only by Intune
Answer: B) Devices are joined to both on-premises AD and registered with Azure AD
Explanation: Hybrid Azure AD join allows devices to be recognized in both environments.
17. Which of the following is a requirement for enrolling iOS devices in Intune?
A) Devices must be jailbroken
B) Devices must have Apple Push Notification service (APNs) configured
C) Devices must be connected via USB to a Windows PC
D) Devices need to be enrolled manually with no cloud connection
Answer: B) Devices must have Apple Push Notification service (APNs) configured
Explanation: APNs is necessary for Intune to manage and communicate with iOS devices.
18. What does Endpoint Security in Microsoft Endpoint Manager help manage?
A) Device inventory
B) Security baselines, antivirus, firewall, disk encryption, and attack surface reduction
C) User license assignments
D) Office 365 subscriptions
Answer: B) Security baselines, antivirus, firewall, disk encryption, and attack surface reduction
Explanation: Endpoint Security focuses on enforcing and monitoring security policies on devices.
19. Which Intune feature allows deploying apps only to corporate-owned devices?
A) Device enrollment restrictions
B) Device compliance policies
C) App protection policies with enrollment restrictions
D) Conditional Access policies
Answer: C) App protection policies with enrollment restrictions
Explanation: App protection policies can target apps on devices with specific enrollment and ownership types.
20. How do you assign an app deployment to users or devices in Intune?
A) Use Azure AD security groups or device groups
B) Assign to all devices only
C) Assign apps via Windows Update policies
D) Assign apps manually on each device
Answer: A) Use Azure AD security groups or device groups
Explanation: Intune uses groups for targeted deployment of apps and policies.
21. Which tool is used to collect diagnostic logs from managed devices for troubleshooting in Intune?
A) Event Viewer
B) Microsoft Endpoint Manager admin center
C) Intune Diagnostic Logs (via Company Portal or remote actions)
D) Azure Monitor
Answer: C) Intune Diagnostic Logs (via Company Portal or remote actions)
Explanation: Admins can request logs remotely from devices to diagnose issues.
22. What is the maximum number of apps that can be assigned per device in Intune?
A) 100
B) 500
C) There is no hard limit documented by Microsoft
D) 50
Answer: C) There is no hard limit documented by Microsoft
Explanation: Microsoft does not specify a hard limit but recommends managing app assignments carefully.
23. How can you ensure a Windows device complies with password requirements using Intune?
A) By configuring device compliance policies with password rules
B) By installing third-party software
C) By manually instructing users to set passwords
D) Password rules cannot be enforced via Intune
Answer: A) By configuring device compliance policies with password rules
Explanation: Compliance policies can enforce password complexity, length, and expiration.
24. What is the purpose of a security baseline in Microsoft Endpoint Manager?
A) To configure user licenses automatically
B) To provide recommended security settings for devices to meet best practices
C) To restrict internet access
D) To install antivirus software
Answer: B) To provide recommended security settings for devices to meet best practices
Explanation: Security baselines are predefined groups of settings recommended by Microsoft.
25. Which Windows feature helps prevent untrusted applications from running, and can be configured via Intune?
A) BitLocker
B) Windows Defender Application Control (WDAC)
C) Windows Hello
D) Device Guard
Answer: B) Windows Defender Application Control (WDAC)
Explanation: WDAC restricts which code can run on a device to reduce malware risk.
26. What does the term ‘Selective Wipe’ mean in Intune?
A) Wiping only personal data on a device
B) Wiping only corporate data while leaving personal data intact
C) Wiping the entire device
D) Wiping the device after 30 days of inactivity
Answer: B) Wiping only corporate data while leaving personal data intact
Explanation: Selective wipe removes only corporate apps and data from personal or BYOD devices.
27. How does Intune handle app updates for Win32 apps?
A) Automatically updates without admin intervention
B) Requires manual update package deployment through Intune
C) Updates only through Microsoft Store
D) Intune does not support Win32 app updates
Answer: B) Requires manual update package deployment through Intune
Explanation: Win32 apps require admins to upload and deploy updated packages.
28. What is the primary benefit of using Dynamic Groups in Azure AD for Intune management?
A) Groups never change membership
B) Users or devices are automatically added based on criteria, simplifying management
C) Groups can only contain users, not devices
D) Groups require manual updates
Answer: B) Users or devices are automatically added based on criteria, simplifying management
Explanation: Dynamic groups help automate assignments and policy targeting.
29. Which setting controls whether users can enroll their personal devices in Intune?
A) Enrollment restrictions
B) Compliance policies
C) Device configuration profiles
D) Conditional Access policies
Answer: A) Enrollment restrictions
Explanation: Enrollment restrictions define who can enroll devices and what device types are allowed.
30. What role does Azure AD Conditional Access play in device compliance enforcement?
A) It blocks access if a device is non-compliant
B) It installs antivirus on devices
C) It monitors network bandwidth usage
D) It updates Windows Defender automatically
Answer: A) It blocks access if a device is non-compliant
Explanation: Conditional Access can enforce access controls based on device compliance status.