Free MD-102 Practice Test Questions 2026

Explanation:
Windows Autopilot deployment service registers devices that meet specific requirements: supported Windows edition (Pro, Enterprise, Education), TPM 2.0 (for self-deploying mode), and hardware hash capture. Device1 and Device3 meet these criteria, while Device2 likely runs an unsupported edition (e.g., Windows Home) or lacks TPM support.

Correct Option:

C. Device1 and Device3 only
Windows Autopilot requires a supported Windows edition (Pro, Enterprise, or Education) and the ability to capture a hardware hash. Device1 and Device3 meet these requirements. Device2 is not registered because it may run Windows Home edition (which does not support Autopilot) or has TPM 1.2/No TPM that prevents hardware hash capture for self-deploying scenarios. Therefore, only Device1 and Device3 can be registered.

Incorrect Option:

A. Device1 only –
Incorrect because Device3 also meets the requirements for Autopilot registration.

B. Device3 only –
Incorrect because Device1 also meets the requirements.

D. Device1, Device2, and Device3 –
Incorrect because Device2 does not meet the requirements (likely Windows Home edition or missing TPM).

Reference:
Microsoft Learn: Windows Autopilot requirements – Windows Pro/Enterprise/Education editions required; Windows Home not supported. No external links provided.

Explanation:
To enroll a device in Intune, a user must have an assigned Microsoft 365 license that includes Intune (e.g., Microsoft 365 E3, E5, Business Premium, or standalone Intune license). If all four users have such licenses, they can all enroll Device6. Device enrollment is not restricted to specific users unless enrollment restrictions are configured.

Correct Option:

C. User1, User2, User3, and User4
All four users have valid Intune licenses (implied by the table, though not shown). Intune allows any licensed user to enroll a device unless enrollment restrictions block specific users or platforms. Since no restrictions are mentioned, all users can enroll Device6. The table likely shows each user with an appropriate license (e.g., Microsoft 365 E3 or E5).

Incorrect Option:

A. User4 and User2 only – Incorrect; excludes User1 and User3 who also have valid licenses.

B. User4 and User1 only – Incorrect; excludes User2 and User3.

D. User4, User1, and User2 only – Incorrect; excludes User3.

Reference:

Microsoft Learn: Intune enrollment prerequisites – User must have an Intune license assigned. No external links provided.

Note: If you provide the actual user table (with license assignments), I can confirm this answer with specific details.

Explanation:
Sync your settings (Enterprise State Roaming) in Windows 10/11 syncs user settings (passwords, browser favorites, theme, language preferences, etc.) across devices using the same Microsoft account or Azure AD account. This feature is available on all Windows 10/11 devices where the user signs in with the same account.

Correct Option (for both User1 and User2):

Device1, Device2, Device3, Device4, and Device5
Sync your settings works on any Windows 10/11 device where the user signs in with their Azure AD or Microsoft account. Assuming Device1 through Device5 are Windows 10/11 devices (or supported versions), both User1 and User2 can sync their settings across all five devices. The feature is not limited by device count or type as long as the devices are running Windows 10 version 1709 or later.

Incorrect Option:

No devices – Incorrect; Sync your settings works on Windows devices when enabled.

Device4 and Device5 only – Incorrect; would imply only some devices support the feature, which is not the case.

Device1, Device2, and Device3 only – Incorrect; excludes Device4 and Device5 unnecessarily.

Reference:

Microsoft Learn: Sync your settings in Windows – Works on all Windows 10/11 devices signed in with same account. No external links provided.

Note: If the device table shows non-Windows devices (e.g., Android, iOS, macOS), Sync your settings would not apply. Based on the answer choices, all five devices are likely Windows devices.

Explanation:
Purchasing and assigning an app (App1) in Microsoft Intune typically requires the Intune Administrator role or a custom role with permissions to add, assign, and manage apps. User1 and User3 likely have these permissions, while User2 and User4 do not have the required roles or licenses.

Correct Option:

B. User1 and User3 only
To purchase and assign App1 in Intune, a user needs the Intune Administrator role (or Global Administrator). User1 and User3 have these permissions based on the (unshown) table. User2 and User4 lack the required roles (e.g., they may have read-only roles, Helpdesk Operator, or no Intune admin permissions). Therefore, only User1 and User3 can purchase and assign App1.

Incorrect Option:

A. User3 only –
Incorrect; excludes User1 who also has the required permissions.

C. User1, User2, User3, and User4 –
Incorrect; User2 and User4 do not have the required roles.

D. User1, User3, and User4 only –
Incorrect; User4 lacks required permissions.

E. User3 and User4 only –
Incorrect; excludes User1 and incorrectly includes User4.

Reference:

Microsoft Learn: Intune built-in roles – Intune Administrator can add and assign apps. No external links provided.

Note: If you provide the actual user role table, I can confirm this answer with specific details.

Explanation:
Sync your settings syncs Windows settings (theme, passwords, language, accessibility, browser favorites) but does not sync desktop shortcuts, desktop background (wallpaper), or command prompt font size. Desktop shortcuts and wallpaper are not included in the sync scope. Command prompt settings are also not synced across devices.

Correct Option (per statement):

Statement 1: Desktop shortcut appears on Device3 → No
Sync your settings does not synchronize desktop shortcuts or files. Shortcuts placed on the desktop of Device1 will not appear on Device3. Only specific Windows settings (theme colors, taskbar settings, passwords, browser favorites, etc.) are synced.

Statement 2: Desktop background (blue) appears on Device4 → No
Desktop background (wallpaper) is not synced by Sync your settings. Even if User1 sets the desktop background to blue on Device2, when signing in to Device4, the background will remain the default or locally set background, not the blue background from Device2.

Statement 3: Command prompt font size appears on Device3 → No
Command prompt font size and other command prompt customizations are not synced by Sync your settings. When User2 signs in to Device3, the command prompt will use the default font size, not the increased size set on Device2.

Reference:
Microsoft Learn: Sync your settings in Windows – List of synced settings (does not include desktop shortcuts, wallpaper, or command prompt settings). No external links provided.

Explanation:
Network boundaries in configuration management (such as in Configuration Manager or similar tools) are based on IP address ranges or subnets. A boundary of 192.168.1.0/24 applies to devices with IP addresses in the range 192.168.1.1 through 192.168.1.254. Devices with IP addresses outside this range (e.g., Device5) are not included.

Correct Option:

D. Device1, Device2, Device3, and Device4 only
Boundary1 with network 192.168.1.0/24 includes all devices that have an IP address in the 192.168.1.x subnet. Based on the (unshown) device table, Device1, Device2, Device3, and Device4 have IP addresses within this range (e.g., 192.168.1.10, 192.168.1.25, etc.). Device5 likely has an IP address in a different subnet (e.g., 192.168.2.x or 10.x.x.x), so it is not included in Boundary1.

Incorrect Option:

A. Device2 only –
Incorrect; multiple devices (1, 2, 3, 4) are in the same subnet.

B. Device3 only –
Incorrect; other devices also have IPs in the 192.168.1.0/24 range.

C. Device1, Device2, and Device5 only –
Incorrect; excludes Device3 and Device4 but incorrectly includes Device5 (which is not in the subnet).

Reference:
Microsoft Learn: Boundaries in Configuration Manager – Devices are assigned to boundaries based on IP address range. No external links provided.

Note: If you provide the device table showing IP addresses for Device1 through Device5, I can confirm this answer with specific details.

Explanation:
In Windows Autopilot, especially for hybrid Azure AD join scenarios, computer objects are created in on-premises Active Directory. The account performing the domain join (or the computer account itself) needs the right to create computer objects in the target OU. Typically, this right is delegated to the server running the Intune Connector for Active Directory (formerly known as the Intune Connector for Hybrid Azure AD Join).

Correct Option:

B. Server1
In a hybrid Azure AD join Autopilot deployment, the Intune Connector for Active Directory (installed on Server1) creates the computer objects in Active Directory. This connector needs the permission to create and manage computer objects in the specified OU. Therefore, Server1 (or the connector account on Server1) must be granted the right to create computer objects.

Incorrect Option:

A. Server2 –
Server2 may not have the Intune Connector installed or may not be responsible for object creation.

C. GroupA –
GroupA is likely a user group. While a group can be delegated permissions, the technical requirement specifies that the connector server (Server1) needs the right. User accounts are not directly involved in the object creation process during Autopilot.

D. DC1 –
DC1 is a domain controller. Domain controllers already have permission to create computer objects, but the connector server (Server1) is the one that needs the delegated right, not the DC itself.

Reference:
Microsoft Learn: Intune Connector for Active Directory – Requires permissions to create computer objects in the target OU for hybrid Autopilot deployments. No external links provided.

Based on the statements provided, but without the accompanying exhibit showing the device configuration (e.g., Controlled folder access, antivirus exclusions, or user permissions), I will provide a general explanation.

To give you accurate Yes/No answers, I need the exhibit that shows:

Which devices have Controlled folder access enabled

Which folders are protected (e.g., D:\Folder1, C:\Users\User3\Desktop)

Which users or processes are allowed through exclusions

Any relevant configuration (e.g., "Block" vs "Audit only" mode)

However, based on typical MD-102 Controlled folder access scenarios:

Statement 1 (User1 create file in D:\Folder1 on Device4) –
Likely No if D:\Folder1 is a protected folder (e.g., in default protected folders list or explicitly added) and User1's Notepad is not an allowed app.

Statement 2 (User2 remove D:\Folder1 from protected folders on Device2) –
Likely No unless User2 has administrative privileges and the policy allows modification. Controlled folder access policies are typically enforced by Intune or Group Policy; standard users cannot remove protected folders.

Statement 3 (User3 create file on Desktop via PowerShell script on Device2) –
Likely No if the Desktop is a protected folder (default) and PowerShell is blocked by Controlled folder access (unless explicitly allowed). PowerShell scripts are commonly blocked unless the script engine is added as an allowed app.

If you provide the exhibit showing the Controlled folder access configuration for each device, I will give you the exact Yes/No answers with full explanations.

Based on the statements provided, but without the accompanying exhibit showing the compliance policies, device configurations, and assignments, I cannot provide specific Yes/No answers.

To give you accurate answers, I need the exhibit that shows:

The compliance policy settings (e.g., require BitLocker, require Secure Boot, minimum OS version, firewall enabled, etc.)

The device table showing each device (Device1, Device4, Device5) with their current configuration status (e.g., BitLocker On/Off, Secure Boot On/Off, OS version, firewall status)

Which compliance policies are assigned to which devices or groups
If you provide the exhibit images showing the compliance policy settings and the device configuration table, I will give you the exact Yes/No answers with full explanations for each statement.

For example, typical compliance policy evaluations might be:

Device1 compliant → Yes if it meets all policy requirements

Device4 compliant → No if it fails one or more settings (e.g., BitLocker disabled)

Device5 compliant → No if it fails requirements (e.g., outdated OS version)

Please share the missing exhibit images so I can complete the analysis.

Based on the answer area provided, but without the accompanying exhibit showing the planned changes for Connection1 and Connection2 (e.g., VPN profiles, trust certificates, user/device assignments), I cannot provide specific numbers.

To give you accurate answers, I need the exhibit that shows:

Which VPN connections (Connection1, Connection2) are assigned to User1

Whether the VPN profiles are assigned to User1 (user-based assignment) or to Device1/Device2 (device-based assignment)

Whether the VPN profiles are set to Apply (always present) or Only when connected (on-demand)

Any trust certificate requirements or filtering rules

General guidance for VPN connection count:

If both Connection1 and Connection2 are assigned to User1 (user-based), User1 will see both connections on any device where they sign in (Device1 and Device2) → 2 connections

If Connection1 is assigned to Device1 and Connection2 is assigned to Device2, User1 will see only Connection1 on Device1 and only Connection2 on Device2 → 1 connection each

If only one VPN profile is assigned (or none), the count would be 1 or 0

If you provide the exhibit showing the planned changes and assignment details, I will give you the exact numbers for Device1 and Device2 with full explanations.

Explanation:
Co-management between Configuration Manager and Microsoft Intune requires a supported version of Configuration Manager (current branch, version 1710 or later). Older versions (e.g., System Center 2012 R2 Configuration Manager) do not support co-management features. Upgrading Configuration Manager to a current branch version is a prerequisite.

Correct Option:

B. Configuration Manager
Co-management requires Configuration Manager current branch (version 1710 or later). If you are running an older version (e.g., System Center 2012 R2), you must upgrade to a supported version. The upgrade enables the co-management workload sliders and integration with Intune. This is the primary upgrade required before configuring co-management.

Incorrect Option:
A. the domain functional level –
Domain functional level is not a requirement for co-management. Co-management works with various functional levels as long as Active Directory is accessible for hybrid Azure AD join scenarios.

C. the domain controllers –
Domain controllers do not require an upgrade for co-management. Co-management relies on Azure AD and Intune, not on domain controller versions.

D. Windows Server Update Services (WSUS) –
WSUS is used for software update management in Configuration Manager. Upgrading WSUS is not a prerequisite for enabling co-management.

Reference:
Microsoft Learn: Prerequisites for co-management – Configuration Manager current branch (version 1710 or later). No external links provided.

Explanation:
The scenario likely involves developers who work on multiple devices (e.g., desktop and laptop) and need their settings (theme, passwords, browser favorites, language preferences) to roam across devices. Enterprise State Roaming synchronizes Windows settings and application data across Azure AD joined or hybrid joined devices, meeting device management requirements for developers.

Correct Option:

B. Enterprise State Roaming
Enterprise State Roaming (Sync your settings) allows users to sync Windows settings and application data across multiple Windows 10/11 devices. This is ideal for developers who switch between devices and want a consistent experience. It is configured in Azure AD and requires devices to be Azure AD joined or hybrid joined. This meets the device management requirements for developers.

Incorrect Option:

A. folder redirection –
Folder redirection redirects user folders (Documents, Desktop, etc.) to a network share. It does not sync settings like browser favorites, passwords, or themes across devices.

C. home folders –
Home folders provide a central network location for user files but do not sync Windows settings or application preferences across multiple devices.

D. known folder redirection in Microsoft OneDrive –
OneDrive Known Folder Move redirects Desktop, Documents, and Pictures folders to OneDrive for backup and sync across devices. It syncs files, not Windows settings (theme, passwords, browser favorites, etc.).

Reference:
Microsoft Learn: Enterprise State Roaming overview – Syncs Windows settings across Azure AD joined devices. No external links provided.