Microsoft 365 Endpoint Administrator

MD-102 Practice Test

Start today’s free 10-question MD-102 set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 200 Verified Questions

Questions updated at Aug 6, 2026, 10:37 PM CDT

Start Daily Practice Open Dashboard

Go Pro - One Time Unlock

Unlock the full MD-102 bank

200 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

$4.99 One-time payment

See bundle and PDF options

We will confirm your site email in one quick checkout step.

Why DotCreds?

Practice with explanations that teach.

Source links for every answer Every wrong answer explained Guided Course included Practice and Exam Mode Weak-area tracking Same verified bank across web practice

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Today's 10 MD-102 questions

Use this MD-102 practice test to review Microsoft 365 Endpoint Administrator. Questions rotate daily and each answer links back to the source used to write it.

Today’s Set

10 questions

Rotates at 10:00 AM local time

Progress

0/10

Answered on this page

Accuracy

Loading countdown…

200 verified questions are in the live bank. Free daily questions are selected from a rotating sample set. Unlock Pro to access the full question bank.

Preparing today’s free questions... Ordering the final locked-bank set before showing the practice cards.

Question 1 of 10

Objective Manage operating system updates Protect devices

A production update ring was paused after a pilot application failed. The application has been fixed and validated, but the ring has remained paused for four months and devices are missing quality updates. What should the administrator do?

Concept tested:

Source:Windows update settings for Intune

Question 2 of 10

Objective Implement identity and compliance controls Prepare infrastructure for devices

A custom Intune role contains the correct application-management permissions, but it is assigned to the wrong administrator group and grants organization-wide scope. Only regional app administrators should manage applications for their region. What should be corrected?

Concept tested:

Question 3 of 10

Objective Configure and manage device configuration profiles Manage and maintain devices

A Windows security setting reports a conflict. The same setting appears in an administrative template, a security profile, and a custom profile assigned through overlapping groups. An engineer assumes the newest profile wins. What should happen instead?

Concept tested:

Question 4 of 10

Objective Monitor and improve endpoint operations Optimize endpoint operations by using automation, monitoring, and reporting

Enrollment failures suddenly appear across unrelated device platforms and locations. Individual devices show recent check-ins, and no enrollment or compliance policy was changed. What should the endpoint team investigate first?

Concept tested:

Question 5 of 10

Objective Deploy and update applications Manage and secure applications

A required application must continue installing on warehouse tablets overnight, but the company wants to suppress supported Intune notifications during the night shift. The application must remain applicable and required. What should the administrator do?

Concept tested:

Question 6 of 10

Objective Enroll devices in Microsoft Intune Prepare infrastructure for devices

Employees use personally owned Android phones. The company needs a managed container for organizational apps and data but must leave personal apps, photos, and settings outside full-device management. Which enrollment method should it select?

Concept tested:

Question 7 of 10

Objective Implement endpoint security policies and Defender integration Protect devices

An organization wants risky device signals from Microsoft Defender for Endpoint to block cloud access. It also wants to reduce a specific script-based attack technique without assuming that one control replaces antivirus or EDR. Which design meets both needs?

Concept tested:

Question 8 of 10

Objective Implement Windows deployment and provisioning Manage and maintain devices

A retailer is preparing Windows devices that will run a shared point-of-sale kiosk. No employee should sign in during provisioning, and each device must complete deployment without user credentials. Which Windows Autopilot mode best fits?

Concept tested:

Question 9 of 10

Objective Automate endpoint management by using PowerShell and Microsoft Graph Optimize endpoint operations by using automation, monitoring, and reporting

A scheduled PowerShell job must update supported Intune objects with Microsoft Graph without a signed-in administrator. Which authentication and execution approach is appropriate?

Concept tested:

Question 10 of 10

Objective Implement app protection and app configuration policies Manage and secure applications

Personal phones may access company files only through supported protected apps. Access must be denied when the required app protection policy is absent, and offboarding must remove only organizational app data. Which controls should work together?

Concept tested:

Locked preview

You are viewing today’s free 10. Unlock 190 more questions.

Unlock full bank

Daily sample Rotating practice Free daily questions are selected from a rotating sample set.

Pro bank Full access Unlock Pro to access the full question bank, Exam Mode, Practice Mode, and random tests.

MD-102 Pro $4.99 one-time

Unlock all 200 MD-102 questions, explanations, review tools, and exam-style practice.

50 Exam Practice Test $1.99 one-time

A 50-question MD-102 PDF for short review sessions. Questions come first, then the answer review and explanations later in the file.

Choose an unlock option to continue. We will confirm your site email in one quick checkout step.

Secure checkout powered by Stripe. Source-backed questions. Not brain dumps. Checkout stays on this page and unlocks the same Pro builder on this practice page.

Already Pro? Open dashboard

MD-102 MD-102

Build your practice session

Choose how you want to study today. DotCreds will build the session from your unlocked full bank.

200verified questions Source-backedexplanations UpdatedAug 6, 2026, 10:37 PM CDT iPhonesame bank

Pass plan

Set your target once.

We will keep the next study action visible before every Pro session.

Exam date Target confidence score Daily minutes

Do this next: start Practice Mode with 20 questions to build your baseline.

Customize your session

Pick the size, question pool, mode, and timer before you start.

Question count How many questions do you want?

Question count

Question set What questions should we include?

Question set

Session mode How would you like to practice?

Session mode Practice mode Instant feedback after each answer. Exam mode No explanations until you submit.

Timer Set a time limit per question.

Timer: 1 minute per question

Extra features Choose which coaching cards appear after answers.

Why Users Miss On Interview Questions On Why This Matters On

Course Mode Course Notes Study Guide My Dashboard 10 questions · Practice mode · Untimed

Purchase options

Unlock the full MD-102 bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

200 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 190 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

7-day score keeper

Answer questions today and this will become a rolling 7-day scorecard.

Local history

Optional progress sync

Keep today’s practice moving

Guest progress saves automatically on this device. Add an email later when you want a magic link that keeps your daily MD-102 practice in sync across browsers.

Guest progress saves on this device automatically

Source-backed answer review

The free daily MD-102 set includes crawlable question text, answer choices, correct answer labels, objective mapping, and source links. Only the first SEO card includes answer explanations and any extra learning features. Pro-only bank questions stay locked; this section mirrors only the 10 free daily questions already shown on this page.

Question 1 A production update ring was paused after a pilot application failed. The application has been fixed and validated, but the ring has remained paused for four months and devices are missing quality updates. What should the administrator do?

Answer choices

A. Keep the ring paused permanently because a pause is the preferred compatibility solution
B. Use Delivery Optimization to approve the missing quality updates while the ring stays paused
C. Replace all ring assignments with one immediate deployment to every device
D. Resume the validated staged rollout and monitor update states rather than using pause as a permanent substitute for compatibility remediation

Correct answer

Resume the validated staged rollout and monitor update states rather than using pause as a permanent substitute for compatibility remediation

A ring pause is a temporary deployment control, not a lasting resolution to application compatibility. After the issue is fixed and validated, staged rings should resume so quality servicing continues with controlled exposure and reporting.

Wrong-answer review

A. Keep the ring paused permanently because a pause is the preferred compatibility solution: Permanent pause leaves security and reliability fixes unapplied even after the documented compatibility cause is resolved.
B. Use Delivery Optimization to approve the missing quality updates while the ring stays paused: Delivery Optimization affects content delivery and cannot approve content or override a paused deployment ring.
C. Replace all ring assignments with one immediate deployment to every device: Immediate broad deployment discards the risk reduction supplied by progressively broader rings.

Extra learning features

Why this matters

A paused update ring for four months results in devices missing critical security and reliability fixes, potentially exposing the organization to vulnerabilities and operational disruptions. Prompt action is needed to restore timely updates and minimize these risks. This is a direct consequence of delayed deployment and highlights the importance of proactive management. (34 words)

Objective/domain: Protect devices

Source: Windows update settings for Intune

Question 2 A custom Intune role contains the correct application-management permissions, but it is assigned to the wrong administrator group and grants organization-wide scope. Only regional app administrators should manage applications for their region. What should be corrected?

Answer choices

A. Add scope tags only and leave the wrong member group because tags also choose role members
B. Remove the application permissions and grant every regional administrator Global Administrator
C. Keep organization-wide assignment scope because role permissions cannot be scoped
D. Assign the role to the correct regional member group and use the narrow regional assignment scope and tags appropriate to those objects

Correct answer

Assign the role to the correct regional member group and use the narrow regional assignment scope and tags appropriate to those objects

Objective/domain: Prepare infrastructure for devices

Source: Role-based access control with Microsoft Intune

Question 3 A Windows security setting reports a conflict. The same setting appears in an administrative template, a security profile, and a custom profile assigned through overlapping groups. An engineer assumes the newest profile wins. What should happen instead?

Answer choices

A. Replace every profile with a compliance policy because compliance configures settings
B. Keep the custom profile merely because it was created most recently
C. Trace every applicable profile, group, and assignment filter, then remove or reconcile overlapping configuration
D. Exclude all non-Windows platforms because configuration profiles cannot support multiple platforms

Correct answer

Trace every applicable profile, group, and assignment filter, then remove or reconcile overlapping configuration

Objective/domain: Manage and maintain devices

Source: Create device profiles in Microsoft Intune

Question 4 Enrollment failures suddenly appear across unrelated device platforms and locations. Individual devices show recent check-ins, and no enrollment or compliance policy was changed. What should the endpoint team investigate first?

Answer choices

A. Export one device report and treat every historical status as current
B. Reassign every policy before checking whether the service is healthy
C. Delete the affected device records so the reports become clean
D. Check tenant status, service health, and service communications, then correlate the incident with scoped enrollment reports

Correct answer

Check tenant status, service health, and service communications, then correlate the incident with scoped enrollment reports

Objective/domain: Optimize endpoint operations by using automation, monitoring, and reporting

Source: Microsoft Intune reports

Question 5 A required application must continue installing on warehouse tablets overnight, but the company wants to suppress supported Intune notifications during the night shift. The application must remain applicable and required. What should the administrator do?

Answer choices

A. Change the application to Available so users receive fewer notifications
B. Exclude the tablets from the assignment during every night shift
C. Replace the required application with a web link
D. Configure an appropriate Quiet Time policy while leaving the required assignment in place

Correct answer

Configure an appropriate Quiet Time policy while leaving the required assignment in place

Objective/domain: Manage and secure applications

Source: Add apps to Microsoft Intune

Question 6 Employees use personally owned Android phones. The company needs a managed container for organizational apps and data but must leave personal apps, photos, and settings outside full-device management. Which enrollment method should it select?

Answer choices

A. Corporate-owned fully managed enrollment
B. Personally owned devices with a work profile
C. Corporate-owned dedicated-device enrollment
D. Corporate-owned devices with a work profile

Correct answer

Personally owned devices with a work profile

Objective/domain: Prepare infrastructure for devices

Source: Android enrollment in Microsoft Intune

Question 7 An organization wants risky device signals from Microsoft Defender for Endpoint to block cloud access. It also wants to reduce a specific script-based attack technique without assuming that one control replaces antivirus or EDR. Which design meets both needs?

Answer choices

A. Deploy disk encryption and treat encryption as evidence that the signed-in session is safe
B. Integrate Defender for Endpoint risk with Intune compliance and Conditional Access, and deploy the appropriate attack surface reduction rule
C. Apply a security baseline unchanged to every device and remove all other endpoint security policies
D. Configure only Windows Firewall because it evaluates cloud-access risk and blocks script behavior

Correct answer

Integrate Defender for Endpoint risk with Intune compliance and Conditional Access, and deploy the appropriate attack surface reduction rule

Objective/domain: Protect devices

Source: Manage endpoint security in Microsoft Intune

Question 8 A retailer is preparing Windows devices that will run a shared point-of-sale kiosk. No employee should sign in during provisioning, and each device must complete deployment without user credentials. Which Windows Autopilot mode best fits?

Answer choices

A. User-driven deployment
B. Pre-provisioned deployment followed by an assigned-user sign-in
C. Microsoft Entra registration through Settings
D. Self-deploying mode

Correct answer

Self-deploying mode

Objective/domain: Manage and maintain devices

Source: Windows Autopilot overview

Question 9 A scheduled PowerShell job must update supported Intune objects with Microsoft Graph without a signed-in administrator. Which authentication and execution approach is appropriate?

Answer choices

A. Store a Global Administrator password in the script and ignore partial errors
B. Use delegated permissions with an exported user refresh token
C. Call Graph anonymously and rely on HTTP acceptance as proof of endpoint completion
D. Use consented least-privileged application permissions with protected authentication, plus paging, retry, logging, validation, and idempotent processing

Correct answer

Use consented least-privileged application permissions with protected authentication, plus paging, retry, logging, validation, and idempotent processing

Objective/domain: Optimize endpoint operations by using automation, monitoring, and reporting

Source: Microsoft Graph and Intune

Question 10 Personal phones may access company files only through supported protected apps. Access must be denied when the required app protection policy is absent, and offboarding must remove only organizational app data. Which controls should work together?

Answer choices

A. Conditional Access for the access requirement and app protection with selective wipe for organizational data
B. A full-device wipe and no application-level policy
C. Only an app configuration policy, because it enforces every data and access rule
D. A Windows feature update policy and Company Portal availability

Correct answer

Conditional Access for the access requirement and app protection with selective wipe for organizational data

Objective/domain: Manage and secure applications

Source: App protection policies overview

Where to go after the daily web set

How are MD-102 questions generated?

dotCreds builds MD-102 practice questions from public exam objectives and Microsoft Learn and exam-objective references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

What score do I get?

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

Why use this site?

The site is the fastest way to start MD-102 practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.