Free MD-102 Practice Exam Questions 2026 (With Explanations) — Endpoint Administrator (Intune & Windows 11)

Q: [OVERVIEW]Contoso Global Financial operates 3,800 corporate-owned Windows 11 Enterprise laptops managed with Microsoft Intune and integrated with Microsoft Defender for Endpoint Plan 2 across Paris, London, and New York.[/OVERVIEW] [ENVIRONMENT]• Identity & Access: Microsoft Entra ID P2 with Conditional Access requiring compliant devices for M365 access. • Endpoint Telemetry: Defender for Endpoint connector is enabled in Intune, and devices are already onboarded to the MDE security portal. • Inc

C. Endpoint Detection and Response — Endpoint Detection and Response (EDR) is a critical feature in Microsoft Defender for Endpoint that continuously monitors endpoints to detect, investigate, and respond to advanced threats.

Q: [OVERVIEW]Fabrikam Manufacturing is migrating 1,200 factory engineering workstations to Windows Autopilot using Hybrid Microsoft Entra ID Join so legacy on-premises ERP file shares remain accessible seamlessly during initial rollout.[/OVERVIEW] [ENVIRONMENT]• Server Infrastructure: Intune Connector for Active Directory is installed on SRV-ADCON01 (Windows Server 2022, domain-joined) in OU=Servers. • Target OU: New Autopilot devices must pre-stage computer objects inside OU=Autopilot-Workstations

C. The service account running the Intune Connector for Active Directory lacks the necessary permissions to create computer objects in the designated Organizational Unit (OU). — The Intune Connector for Active Directory is responsible for creating computer objects in the on-premises Active Directory for Autopilot Hybrid Microsoft Entra ID Join devices. When the connector logs indicate a 'Failed to create computer object' error, it almost always points to insufficient permissions for the service account under which the Intune Connector service is running. This service account requires 'Create Computer objects' permissions (and often 'Full control' for newly created objects) on the target Organizational Unit (OU) where the new computer objects are intended to be created. Without these permissions, the connector cannot pre-stage the computer object, which is a prerequisite for the device to successfully join the domain during OOBE. Option A is incorrect because the 'Convert all targeted devices to Autopilot' setting is used for existing devices and does not impact the initial creation of computer objects for new Autopilot deployments. Option C is incorrect because Microsoft Entra ID

Q: [SCENARIO]Your endpoint engineering team must deploy a legacy custom Win32 ERP client (`erp-client-setup.exe`, 420 MB) silently to 600 cloud-only Windows 11 devices managed exclusively by Microsoft Intune without on-premises SCCM infrastructure.[/SCENARIO] [SOLUTION]You download the Microsoft Win32 Content Prep Tool (`IntuneWinAppUtil.exe`), package `erp-client-setup.exe` together with its silent install switches into a `.intunewin` archive, and upload it as a Windows app (Win32) in the Microsof

C. Yes, wrapped as .intunewin — Intune can deploy Win32 apps (.exe, .msi, etc.) if they are wrapped into the .intunewin format using the Microsoft Win32 Content Prep Tool.

Q: [SCENARIO]Northwind Traders runs Configuration Manager (MEMCM) in Co-Management with Microsoft Intune across 4,500 Windows 11 endpoints. Management now requires Conditional Access to verify real-time BitLocker encryption and OS patch compliance evaluated directly by Microsoft Intune.[/SCENARIO] [SOLUTION]During initial Co-Management onboarding, all 7 Co-Management workload sliders were left in the default 'Configuration Manager' position. You open the Co-Management Properties window to reconfigu

C. Compliance policies workload — Switching the Compliance policies workload to Intune ensures Intune evaluates device compliance and reports states directly to Microsoft Entra Conditional Access.

Q: You are authoring a Proactive Remediation script package in Intune to detect and fix an incorrect registry setting on Windows 11 endpoints. What are TWO mandatory technical requirements for the detection and remediation scripts? (Choose two.)

B. Output written to STDOUT in the remediation script is captured and displayed in Intune reporting up to 2048 characters. & C. The detection script must return Exit Code 1 (or any non-zero code) to indicate that an issue was found and remediation is required. — CORRECT: Options C and D. - Intune Proactive Remediations standard: Exit Code 0 = Compliant (no fix needed), Exit Code 1 = Non-compliant (triggers remediation). - STDOUT text is captured in the Intune console (max 2048 chars) for admin audit and troubleshooting. INCORRECT DISTRACTORS: - Option A: They are standard PowerShell .ps1 files, not .dll files. - Option B: Exit Code 0 means the device is clean; it does NOT trigger remediation. - Option E: Forcing a reboot disrupts user workflow and is not mandatory.

Q: You are configuring a Windows Autopilot deployment profile in Microsoft Intune for new field laptops. You need to ensure that the primary user is NOT granted local administrator privileges during OOBE, and that the privacy settings screen is skipped. Which TWO settings should you configure in the Autopilot profile? (Choose two.)

A. Privacy settings: Hide & D. User account type: Standard — CORRECT: Options B and E. - Setting User account type to Standard prevents the user from receiving local administrator rights on Microsoft Entra joined devices. - Setting Privacy settings to Hide skips the Windows diagnostics and privacy configuration screens during OOBE. INCORRECT DISTRACTORS: - Option A grants administrative rights, which violates the requirement. - Option C is for kiosks and shared devices with TPM attestation, not user-driven laptops. - Option D prompts users for language selection instead of automating the flow.

Q: Your management team asks for a breakdown of device health metrics from Microsoft Intune Endpoint Analytics. Which TWO distinct performance pillars are measured and reported by Endpoint Analytics? (Choose two.)

A. Startup performance (boot history and core sign-in score) & D. Application reliability (app crash frequency and mean time between failures) — CORRECT: Options A and C. - Endpoint Analytics focuses on user experience, specifically measuring Startup performance, Application reliability, and Work from anywhere. INCORRECT DISTRACTORS: - Options B, D, and E are datacenter and physical cabling metrics unrelated to Endpoint Analytics.

Q: You are creating an Endpoint Security Disk Encryption policy in Intune for corporate Windows 11 laptops. You need to enforce BitLocker silent enablement without prompting end users, and backup the BitLocker recovery keys securely. Which TWO settings must be configured? (Choose two.)

B. Save BitLocker recovery information to Microsoft Entra ID before encryption starts. & D. Hide prompt about third-party encryption and allow Silent device encryption. — CORRECT: Options C and E. - Silent BitLocker enablement requires hiding third-party prompts and utilizing TPM. - Backing up the recovery key to Microsoft Entra ID prior to encryption ensures administrators can recover encrypted drives without data loss. INCORRECT DISTRACTORS: - Option A requires user interaction (entering a PIN), breaking silent enablement. - Option B prevents BitLocker hardware-backed encryption from functioning. - Option D poses a major security violation.

Q: You are migrating an existing Configuration Manager (SCCM) co-managed environment to pure Microsoft Intune management. While devices are still co-managed, you need remote internet-based devices to download software updates efficiently without saturating the corporate VPN tunnel. Which TWO architectural components accomplish this? (Choose two.)

C. Configure Windows Update for Business (WUfB) rings in Intune to deliver updates directly from the Microsoft Content Delivery Network (CDN). & E. Switch the Windows Update policies workload slider in Co-management to Intune. — CORRECT: Options B and D. - Shifting the Windows Update workload slider in Co-management from Configuration Manager to Intune transfers update authority. - Windows Update for Business (WUfB) rings instruct client machines to pull update binaries directly from Microsoft cloud CDNs, bypassing corporate VPNs. INCORRECT DISTRACTORS: - Option A will saturate the VPN bandwidth. - Option C disrupts CMG services while co-management is still active. - Option E breaks internet connectivity.

Q: You are designing Intune RBAC for a regional IT team in Paris. The Paris team must be able to view and manage device configurations for Paris branch devices only, without being able to see or edit policies applied to other regions. Which TWO Intune RBAC components must you configure? (Choose two.)

A. Scope tags assigned to Paris devices and policies. & C. A custom Intune role assignment binding the Paris admin security group to the Paris Scope Tag. — CORRECT: Options A and D. - Scope tags in Intune filter administrative visibility and control by organizational boundary or region. - Role assignments link the admin user group, permissions, and scope tags together. INCORRECT DISTRACTORS: - Option B grants tenant-wide unlimited access. - Options C and E are unrelated to Intune administrative delegation.

Q1 / 10 CASE STUDY Moderate

Endpoint Security & Compliance

[OVERVIEW]Contoso Global Financial operates 3,800 corporate-owned Windows 11 Enterprise laptops managed with Microsoft Intune and integrated with Microsoft Defender for Endpoint Plan 2 across Paris, London, and New York.[/OVERVIEW] [ENVIRONMENT]• Identity & Access: Microsoft Entra ID P2 with Conditional Access requiring compliant devices for M365 access. • Endpoint Telemetry: Defender for Endpoint connector is enabled in Intune, and devices are already onboarded to the MDE security portal. • Incident History: Last quarter, a fileless PowerShell credential-dumping attempt bypassed basic antivirus signatures for 14 minutes before analysts spotted it manually.[/ENVIRONMENT] [REQUIREMENTS]The CISO mandates continuous behavioral sensor monitoring on every endpoint so the SOC team can automatically detect post-breach lateral movement, investigate execution trees in real time, and trigger rapid threat mitigation directly from the Microsoft Defender portal.[/REQUIREMENTS] [QUESTION]Which core Microsoft Defender for Endpoint capability must be enabled to continuously monitor endpoints and rapidly identify and mitigate threats?[/QUESTION]

Q2 / 10 CASE STUDY Moderate

Device Management

[OVERVIEW]Fabrikam Manufacturing is migrating 1,200 factory engineering workstations to Windows Autopilot using Hybrid Microsoft Entra ID Join so legacy on-premises ERP file shares remain accessible seamlessly during initial rollout.[/OVERVIEW] [ENVIRONMENT]• Server Infrastructure: Intune Connector for Active Directory is installed on SRV-ADCON01 (Windows Server 2022, domain-joined) in OU=Servers. • Target OU: New Autopilot devices must pre-stage computer objects inside OU=Autopilot-Workstations,DC=fabrikam,DC=local. • Network & Sync: Microsoft Entra Connect runs delta sync every 30 minutes and includes OU=Autopilot-Workstations. • Diagnostic Log (ODJConnectorSvc on SRV-ADCON01): Event ID 30130 — 'Failed to create computer object in Active Directory for prefix FAB- with target DN OU=Autopilot-Workstations,DC=fabrikam,DC=local. Access is denied (0x80070005).'[/ENVIRONMENT] [REQUIREMENTS]New bare-metal laptops download the Hybrid Join Autopilot profile successfully during OOBE, pause at the 'Account setup / Joining your organization network' phase, and repeatedly time out with error 0x80070005. Restore zero-touch Hybrid Entra Join provisioning.[/REQUIREMENTS] [QUESTION]Based on the ODJConnectorSvc diagnostic log and environment topology, what is the MOST likely root cause of the failure?[/QUESTION]

Correct option: C

💡 Technical Explanation: The Intune Connector for Active Directory is responsible for creating computer objects in the on-premises Active Directory for Autopilot Hybrid Microsoft Entra ID Join devices. When the connector logs indicate a 'Failed to create computer object' error, it almost always points to insufficient permissions for the service account under which the Intune Connector service is running. This service account requires 'Create Computer objects' permissions (and often 'Full control' for newly created objects) on the target Organizational Unit (OU) where the new computer objects are intended to be created. Without these permissions, the connector cannot pre-stage the computer object, which is a prerequisite for the device to successfully join the domain during OOBE. Option A is incorrect because the 'Convert all targeted devices to Autopilot' setting is used for existing devices and does not impact the initial creation of computer objects for new Autopilot deployments. Option C is incorrect because Microsoft Entra ID Connect synchronization issues would prevent the device from becoming Hybrid Microsoft Entra ID Joined in Microsoft Entra ID *after* the on-premises domain join, but they would not cause the Intune Connector to fail creating the initial computer object in Active Directory. The error occurs earlier in the process. Option D is incorrect as, while network connectivity to domain controllers is essential for the device to *join* the domain, the error message specifically from the *Intune Connector logs* about failing to *create* the computer object points to a permission issue on the connector's side, not a network issue preventing the device from contacting a DC directly to join a *pre-existing* or *newly created* object. The connector's failure to pre-stage the object is the primary issue here.

📚 Official Microsoft Learn Documentation →

Q3 / 10 YES NO Beginner

Application Management & MAM

[SCENARIO]Your endpoint engineering team must deploy a legacy custom Win32 ERP client (`erp-client-setup.exe`, 420 MB) silently to 600 cloud-only Windows 11 devices managed exclusively by Microsoft Intune without on-premises SCCM infrastructure.[/SCENARIO] [SOLUTION]You download the Microsoft Win32 Content Prep Tool (`IntuneWinAppUtil.exe`), package `erp-client-setup.exe` together with its silent install switches into a `.intunewin` archive, and upload it as a Windows app (Win32) in the Microsoft Intune admin center.[/SOLUTION] [QUESTION]Can Intune deploy Win32 apps to achieve this deployment requirement, and how?[/QUESTION]

Q4 / 10 YES NO Expert

Co-Management & Cloud Gateway