Free MD-102 Practice Test Questions 2026

Explanation:
When you pause an update ring policy in Microsoft Intune, devices stop receiving feature and quality updates for a maximum of 35 days from the pause date. After 35 days, the pause automatically expires, and devices resume checking for and installing applicable updates according to the ring settings. All devices remain online, so no additional delays occur.

Correct Option:

C. November 15 –
You paused the policy on November 1. Adding the maximum 35-day pause period gives November 15 (or November 36 in calendar terms, but it lands on the 15th in standard counting). On this date, the pause automatically expires, and devices will next scan for and attempt to install updates from Windows Update without any further policy changes.

Incorrect Option:

A. December 1 –
This would represent a 30-day period, which is the maximum deferral period for quality updates in some configurations, not the pause duration. The pause in update rings is specifically limited to 35 days, not 30.

Incorrect Option:

B. December 6 –
This date is approximately 35 days after November 1, but Intune’s pause behavior uses a 35-day maximum from the exact pause timestamp, resulting in resumption around mid-November, not early December. Devices check in regularly while online.

Incorrect Option:

D. November 22 –
This represents only about 21 days after the pause. The pause does not expire after 21 days; it lasts the full allowed 35 days before automatically lifting.

Reference:
Microsoft Learn documentation on managing Windows Update ring policies in Intune.

Explanation:
App configuration policies in Microsoft Intune deliver custom settings to specific apps. There are two main types: Managed devices (using the OS channel) and Managed apps (using the Intune App SDK / MAM channel). Both types are officially supported only on Android and iOS/iPadOS platforms. Windows devices primarily use device configuration profiles (Administrative Templates or Settings Catalog) for app and browser settings such as Microsoft Edge.

Correct Option:
C. Device3 and Device4 only – Device3 (Android) and Device4 (iOS) fully support app configuration policies. You can create a policy for managed devices or managed apps and deliver key-value pairs or managed configuration settings directly to apps on these mobile platforms. This is the standard and recommended method for configuring mobile apps in Intune.

Incorrect Option:
A. Device2 only – Device2 is Windows 11. While limited support exists for certain apps (e.g., Microsoft Edge via MAM), the general app configuration policy feature is not primarily designed or fully available for Windows in the same way as for mobile platforms. Windows uses other profile types for most configurations.

Incorrect Option:
B. Device1 and Device2 only – Both Device1 (Windows 10) and Device2 (Windows 11) are Windows platforms. App configuration policies are not the recommended or broadly supported method for Windows devices. Password policies or Edge settings on Windows are handled through device configuration profiles instead.

Incorrect Option:
D. Device2, Device3, and Device4 only – This incorrectly includes Device2 (Windows 11). App configuration policies are designed for Android and iOS. Including a Windows device here would not work as expected for standard app configuration scenarios.

Incorrect Option:
E. Device1, Device2, Device3, and Device4 – This option includes both Windows devices (Device1 and Device2), which do not support traditional app configuration policies. Only the mobile platforms (Android and iOS) are fully compatible.

Reference:
Microsoft Learn documentation on App Configuration Policies.

Explanation:
To upgrade Windows 8.1 computers to Windows 10 using the MDT Deployment Wizard (Lite Touch Installation), you first need proper tools on Server1 to create and manage the deployment share. The Windows Assessment and Deployment Kit (ADK) is required because it provides the Windows PE environment and tools needed for MDT to generate boot images and handle deployments. After creating the deployment share, you must add the minimum components: a Windows 10 operating system image plus a task sequence (specifically an Upgrade task sequence template) so the wizard can perform the in-place upgrade while preserving user data, settings, and applications.

Correct Option:

On Server1: Install the Windows Assessment and Deployment Kit (Windows ADK).
This is the essential step. The Windows ADK installs the Deployment Tools, Windows PE, and other components that MDT relies on to create bootable media and support Windows 10 deployments/upgrades. Without the ADK, you cannot properly update the deployment share or generate LiteTouchPE boot images. Other options like importing PowerShell modules or installing WDS are optional or not required for basic MDT upgrade scenarios.

Correct Option:

Add to the MDT deployment share: Windows 10 image and task sequence only
This is the minimum required. You import the Windows 10 installation source (WIM file) under Operating Systems, then create an Upgrade task sequence that references the Windows 10 image. The task sequence drives the upgrade process in the Deployment Wizard. Adding only an image is insufficient because no task sequence means nothing to execute. Packages are optional and not needed for a basic upgrade.

Incorrect Option:
Import the Deployment Image Servicing and Management (DISM) PowerShell module / Import the WindowsAutopilotIntune Windows PowerShell module – These modules are not required for standard MDT upgrade deployments. DISM is already available via the ADK, and Windows Autopilot is a separate cloud-based deployment method, not used with the MDT Deployment Wizard for on-premises upgrades.

Incorrect Option:
Install the Windows Deployment Services server role – WDS is optional for PXE booting. The question specifies using the MDT Deployment Wizard (which can run from boot media, USB, or network share), so WDS is not mandatory for creating the deployment share or performing upgrades.

Incorrect Option:
Windows 10 image and package only / Windows 10 image only / Windows 10 image, task sequence, and package – These are incomplete or excessive. A task sequence is required to define the upgrade steps. Packages (e.g., language packs or updates) are optional and not minimum requirements for a basic Windows 10 upgrade from 8.1.

Reference:
Microsoft Learn documentation on Microsoft Deployment Toolkit and upgrading to Windows 10 with MDT.

Explanation:
App protection policies (also called MAM policies) in Microsoft Intune protect corporate data inside apps on mobile devices (Android and iOS) without requiring full device management. These policies control data transfer, encryption, PIN requirements, and more for apps integrated with the Intune App SDK. While many Microsoft 365 apps support them, the question context and correct answer focus on the specific capability highlighted for Microsoft Edge as a managed browser that can receive and enforce these policies directly.

Correct Option:
D. Microsoft Edge – You can protect Microsoft Edge using an app protection policy. Intune supports applying MAM policies to the Edge app on Android and iOS. This allows you to enforce data protection rules (e.g., restrict copy/paste, require PIN, control web links, and prevent data leakage) inside the browser. Edge is frequently used as the managed browser that opens links from other protected apps, making it a key target for app protection policies.

Incorrect Option:
A. Microsoft Outlook – Outlook is a very common app protected by Intune app protection policies for email and calendar data. However, in the context of this specific exam question, the expected answer is Microsoft Edge (likely testing knowledge of the managed browser scenario rather than the more obvious Outlook use case).

Incorrect Option:
B. Microsoft OneDrive – OneDrive supports app protection policies for controlling file sync and data sharing. It is commonly included in MAM policies, but again, the question’s correct selection points to Microsoft Edge as the intended answer for this scenario.

Incorrect Option:
C. Microsoft Teams – Teams is supported for app protection policies on most platforms to protect chat, meetings, and file sharing. However, there are some platform-specific limitations (e.g., on certain Android Teams devices), and the exam expects Microsoft Edge as the answer here.

Reference:
Microsoft Learn documentation on Intune App Protection Policies.

Explanation:
When Intune is configured to send log data to Log Analytics, different log categories are available. Operational logs contain detailed information about device enrollment attempts, including successful and failed enrollments, enrollment errors, and troubleshooting data for enrollment issues. These logs are the primary source for reviewing why devices fail to enroll in Intune. Audit logs track administrative changes, while compliance logs focus on policy compliance status rather than enrollment failures.

Correct Option:
A. operational logs – This is the correct choice. Operational logs in Intune (when sent to Log Analytics) include enrollment-related events such as device enrollment requests, failures, error codes, and detailed diagnostics. You can query these logs in Log Analytics to identify and troubleshoot devices that fail to enroll. Microsoft recommends using operational logs specifically for monitoring enrollment issues and device management operations.

Incorrect Option:
B. audit logs – Audit logs record administrative actions performed in the Intune admin center, such as creating policies, assigning groups, or changing settings. They do not contain device enrollment attempt details or failure reasons. Audit logs are useful for compliance and change tracking, but not for enrollment troubleshooting.

Incorrect Option:
C. the Intune Device log – There is no specific log category called “Intune Device log” in Log Analytics for Intune. Device-related information is spread across operational logs, device compliance logs, and other categories. This option does not exist as a monitorable entity for enrollment failures.

Incorrect Option:
D. device compliance organizational logs – Device compliance logs track whether enrolled devices meet compliance policies (e.g., encryption status, OS version). They do not include enrollment attempt events or failures during the enrollment process itself. These logs only apply after a device has successfully enrolled.

Reference:
Microsoft Learn documentation on Intune logs in Log Analytics.

Explanation:
You have 100 Azure AD-joined Windows 10 computers with no on-premises servers. To centrally manage Windows Update while minimizing internet traffic and costs, use Windows Update for Business (now part of Microsoft Intune). This allows you to create update rings or feature update policies directly in Intune. Since there are no servers, you cannot use WSUS or Configuration Manager. Delivery Optimization is the best way to reduce internet bandwidth by allowing peer-to-peer sharing of update files among the devices on the local network.

Correct Option:

Windows Update technology to use: Windows Update for Business
This is the correct choice because the computers are Azure AD joined and there are no on-premises servers. Windows Update for Business lets you manage updates centrally through Microsoft Intune (part of your Microsoft 365 subscription) without needing WSUS or Configuration Manager. It fully supports deferral, feature updates, quality updates, and driver updates for Windows 10 devices.

Correct Option:

Manage the configuration by using: Microsoft Intune
Microsoft Intune is the central management tool for Azure AD-joined devices. You can create update ring policies or use the new Windows Update for Business deployment service in Intune to control update behavior for all 100 computers from a single location. This meets the “managed from a central location” requirement without any additional infrastructure.

Correct Option:

Manage the traffic by using: Delivery Optimization
Delivery Optimization reduces internet traffic by allowing Windows 10 devices to download update files from other local devices (peer-to-peer) in addition to Microsoft Update servers. It works perfectly in a pure cloud environment with no servers and helps minimize bandwidth usage and costs. BranchCache and Peer cache require servers or Configuration Manager, which you do not have.

Incorrect Option:
Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager – Both require on-premises servers, which you do not have. Using them would increase costs and complexity, violating the requirements.

Incorrect Option:
A Group Policy object (GPO) – GPOs require an on-premises Active Directory domain. Since the computers are Azure AD joined only, you cannot use traditional GPOs for Windows Update management.

Incorrect Option:
BranchCache or Peer cache – These technologies require additional server infrastructure (BranchCache server or Configuration Manager) and are not suitable when you have no servers and want to minimize costs.

Reference:
Microsoft Learn documentation on Windows Update for Business and Delivery Optimization in Intune.

Explanation:
Windows Autopilot is used to automatically provision and configure new Windows 11 devices during the Out-of-Box Experience (OOBE). To customize the OOBE settings (such as hiding the privacy settings page, skipping the EULA, disabling account setup, setting language/region, or controlling user experience), you must create an Autopilot deployment profile in the Microsoft Intune admin center. This profile directly controls the behavior and appearance of the OOBE for Autopilot-provisioned devices.

Correct Option:
B. a deployment profile – This is the correct answer. In Intune, you create an Autopilot deployment profile (also called Windows Autopilot deployment profile) specifically to configure Out-of-Box Experience (OOBE) settings. You can define options like user account type, privacy settings, language/region, hiding pages during OOBE, and whether the device joins Azure AD. The profile is then assigned to the Autopilot-registered devices. This is the standard and required method for customizing OOBE in Autopilot deployments.

Incorrect Option:
A. an enrollment status page (ESP) – The Enrollment Status Page shows progress during Autopilot enrollment and app installation. While useful, it does not control OOBE settings such as which screens appear or are hidden during initial device setup.

Incorrect Option:
C. a compliance policy – Compliance policies check device health and security status after enrollment. They have no effect on the Out-of-Box Experience or initial device provisioning screens.

Incorrect Option:
D. a PowerShell script – PowerShell scripts can run post-enrollment for additional configuration, but they cannot customize the OOBE screens that appear before the user reaches the desktop. Deployment profiles are required for OOBE control.

Incorrect Option:
E. a configuration profile – Device configuration profiles (Administrative Templates, Settings Catalog, etc.) are used for post-enrollment settings. They do not control the Autopilot OOBE experience. Only the Autopilot deployment profile manages OOBE settings.

Reference:
Microsoft Learn documentation on Windows Autopilot deployment profiles.

Explanation:
To integrate Microsoft Intune with Microsoft Defender for Endpoint, you need to establish a service-to-service connection. This allows Intune to send device information to Defender for Endpoint and enables features such as endpoint security policies, threat response, and Conditional Access based on device risk. The connection is configured in the Microsoft Endpoint Manager admin center (now Microsoft Intune admin center) under Connectors and tokens. This is where you enable the Microsoft Defender for Endpoint connector.

Correct Option:
A. Connectors and tokens – This is the correct location. In the Microsoft Intune admin center, go to Tenant administration > Connectors and tokens > Microsoft Defender for Endpoint. Here you can turn on the connector, which establishes the service-to-service connection between Intune and Defender for Endpoint. Once enabled, Intune can share enrollment data and Defender for Endpoint can report device risk levels back to Intune. This is the standard and required step for the integration.

Incorrect Option:
B. Premium add-ons – Premium add-ons are used to purchase and enable additional Intune Suite features or other Microsoft 365 add-ons. It does not contain settings to establish the service-to-service connection with Microsoft Defender for Endpoint.

Incorrect Option:
C. Microsoft Tunnel Gateway – Microsoft Tunnel is a VPN gateway solution for secure access to on-premises resources from mobile devices. It is unrelated to integrating Intune with Microsoft Defender for Endpoint.

Incorrect Option:
D. Tenant enrollment – Tenant enrollment settings control how devices enroll into Intune (e.g., MDM user scope, automatic enrollment). They do not handle the service-to-service connection required for Defender for Endpoint integration.

Reference:
Microsoft Learn documentation on integrating Microsoft Defender for Endpoint with Intune.

Explanation:
Attack Surface Reduction (ASR) rules in Microsoft Intune are part of Endpoint security policies. When you enable ASR rules (especially "Block Adobe Reader from creating child processes" or similar rules), legitimate plug-ins or processes can sometimes get blocked unintentionally. To allow specific files, folders, or processes without disabling the entire rule, Intune provides ASR Only Per Rule Exclusions. This feature lets you add targeted exclusions for a particular ASR rule while keeping the rest of the policy intact.

Correct Option:

C. Configure ASR Only Per Rule Exclusions in Profile1.
This is the correct solution. In the existing Attack Surface Reduction Rules profile (Profile1), you can edit the policy and add an exclusion under ASR Only Per Rule Exclusions. You specify the exact ASR rule that is blocking the Adobe Reader plug-in and add the necessary exclusion path or process (e.g., the plug-in executable or folder). This unblocks the plug-in for all assigned devices without weakening other ASR rules or creating a new policy.

Incorrect Option:

A. Create an Endpoint Privilege Management policy and assign the policy to all the devices.
Endpoint Privilege Management is used to control elevation of privileges (standard user to admin). It has no relation to Attack Surface Reduction rules or unblocking a plug-in blocked by ASR.

Incorrect Option:

B. Add a scope tag to Profile1.
Scope tags are used for role-based access control (RBAC) to limit which admins can see or manage the policy. Adding a scope tag does not affect rule behavior or unblock the Adobe Reader plug-in.

Incorrect Option:

D. Create a device compliance policy and assign the policy to all the devices.
Device compliance policies evaluate device health and security state. They cannot add exclusions to ASR rules or unblock processes blocked by attack surface reduction policies.

Reference:
Microsoft Learn documentation on Attack Surface Reduction rules exclusions in Intune.

Explanation:
To monitor an on-premises Windows 11 device using Azure Monitor, you must install the Azure Monitor Agent (AMA) on the device. A Data Collection Rule (DCR) defines what data to collect (performance counters, event logs, etc.) and where to send it. For the DCR to apply to a specific on-premises device, it must be directly associated with that device (or a machine group containing the device). This association tells the Azure Monitor Agent on Device1 which rule to use for data collection.

Correct Option:

B. Device1
This is the correct answer. After creating DCR1, you associate the Data Collection Rule directly with the on-premises device (Device1). This is done in the Azure portal under the DCR settings by adding the machine as a monitored resource. Once associated, the Azure Monitor Agent on Device1 starts collecting and sending the defined data to the linked Log Analytics workspace according to DCR1. Associating the DCR with the actual device is the required step for on-premises monitoring.

Incorrect Option:

A. Azure Network Watcher
Azure Network Watcher is used for network monitoring and diagnostics (packet capture, NSG flow logs, etc.). It has no role in associating a Data Collection Rule for monitoring a Windows device with Azure Monitor.

Incorrect Option:

C. a Log Analytics workspace
While a DCR must send data to a Log Analytics workspace (this is configured inside the DCR), you do not associate the DCR with the workspace itself. The association is made with the data source — in this case, the on-premises device.

Incorrect Option:

D. a Monitored Object
There is no object called “Monitored Object” in Azure Monitor for this purpose. The correct association for on-premises servers/devices is directly with the machine (Device1) after the Azure Monitor Agent is installed.

Reference:
Microsoft Learn documentation on Data Collection Rules and Azure Monitor Agent for on-premises machines.

Explanation:
In a hybrid Azure AD join scenario, devices first join the on-premises Active Directory domain and then register with Azure AD. The "Pending" state usually means the device has successfully joined the on-premises domain but is stuck while trying to register with Azure AD. This registration process requires the device to communicate with both the on-premises domain controllers (for Kerberos/NTLM authentication and certificate requests) and Azure AD. If a device cannot reach a domain controller, the hybrid join process fails to complete.

Correct Option:

C. that each computer has a line of sight to a domain controller
This is the correct answer. For hybrid Azure AD join to succeed, the Windows 11 computers must have direct network connectivity (line of sight) to an on-premises domain controller in the contoso.com domain. The device uses the domain controller to obtain the necessary Kerberos ticket and perform the device registration steps with Azure AD. Lack of connectivity to a domain controller is one of the most common reasons for the "Pending" state. Ensuring line of sight resolves the issue.

Incorrect Option:

A. that Windows is activated on all the computers
Windows activation is not required for hybrid Azure AD join. Devices can complete hybrid join successfully even if Windows is not yet activated. Activation is unrelated to the registration process.

Incorrect Option:

B. that the users of the computers are assigned Microsoft 365 licenses
Microsoft 365 licenses are not required for hybrid Azure AD join. The join process is handled at the device level using Azure AD Connect synchronization and does not depend on user licenses.

Incorrect Option:

D. that the computers contain the latest quality updates
While keeping devices updated is a good practice, missing quality updates are rarely the direct cause of a "Pending" hybrid join state. The primary requirement is network connectivity to a domain controller, not the latest patches.

Reference:
Microsoft Learn documentation on troubleshooting hybrid Azure AD join.

Explanation:
Windows Autopilot and in-place upgrade behave differently based on device join type and current OS version. Windows Autopilot (Self-Deploying or User-Driven mode) works only on Azure AD joined devices and is designed for new or wiped devices. It cannot be used for in-place upgrades while retaining user settings and applications. In-place upgrade (using Windows Setup or MDT/Intune) can upgrade Windows 10 to Windows 11 while keeping user profiles, settings, and installed applications, but it works best on domain-joined or workgroup devices and does not require Azure AD join.

Correct Option:

Windows Autopilot: Device1 only
Only Device1 is Azure AD joined. Windows Autopilot requires Azure AD join (or hybrid join in some modes) and is primarily used for provisioning new or reset devices. Since Device2 and Device3 are not Azure AD joined, they cannot use Windows Autopilot for the upgrade. Device1 can be prepared for Autopilot by resetting it first, but the question focuses on retaining user settings — Autopilot is generally not ideal for that.

Correct Option:

In-place upgrade: Device1 and Device3 only
In-place upgrade from Windows 10 Pro to Windows 11 Pro (retaining all user settings and applications) is supported on both 32-bit and 64-bit versions. However, Device2 is 32-bit Windows 10 Pro. Microsoft does not support in-place upgrade from 32-bit to 64-bit Windows 11. Device1 (64-bit, Azure AD joined) and Device3 (64-bit, not joined) can both perform a successful in-place upgrade to Windows 11 while keeping user data and LOB apps.

Incorrect Option:
Device1 and Device3 only (for Windows Autopilot) – Incorrect. Autopilot is limited to Azure AD joined devices only (Device1). Device3 is not Azure AD joined, so it cannot use Autopilot.

Incorrect Option:
Device1, Device2, and Device3 (for either method) – Incorrect. Device2 is 32-bit, which blocks in-place upgrade to 64-bit Windows 11. Autopilot also cannot be used on non-Azure AD joined devices (Device2 & Device3).

Incorrect Option:
None of the devices – Incorrect. Device1 supports Autopilot (after reset), and Device1 + Device3 support in-place upgrade.

Reference:
Microsoft Learn documentation on Windows Autopilot and in-place upgrade to Windows 11.