Free MD-102 Practice Test Questions 2026

Explanation:
To create a customized installation of Microsoft 365 Apps, you first download the ODT, extract it, edit the XML configuration file (specifying architecture, update channel, excluded apps, etc.), then download the source files using the /download switch, and finally run /configure to install the customized suite.

Correct Option (in correct sequence):

1. Download the Microsoft Office Deployment Tool (ODT) and run the self-extracting executable (.exe) file
First, download ODT from Microsoft. Run the self-extracting executable to extract the setup.exe and sample configuration files to a folder on your computer.

2. Edit the XML configuration file
Edit the configuration.xml file to specify your custom settings, such as architecture (64-bit), update channel (Monthly Enterprise), excluded apps (e.g., Access, Publisher), language, and logging options.

3. Run setup.exe and specify the /download switch
Run setup.exe /download configuration.xml to download the Office source files from the Microsoft CDN to a local folder. This step requires an internet connection and downloads all required installation files.

4. Run setup.exe and specify the /configure switch
Run setup.exe /configure configuration.xml to install Microsoft 365 Apps on the target computer using the previously downloaded source files and the custom XML configuration.

Incorrect Option (action not used):
Run setup.exe and specify the /packager switch – The /packager switch is used to create an App-V package, not for standard custom installations of Microsoft 365 Apps for enterprise.

Reference:
Microsoft Learn: Office Deployment Tool – Steps: Download ODT, edit XML, use /download, then /configure. No external links provided.

Explanation:
The exhibit shows Quality update deferral period = 0 days (installed immediately) and Feature update deferral period = 30 days. Quality updates contain fixes and improvements; feature updates contain new Windows functionality. Feature updates will be installed 30 days after release based on the deferral period.

Correct Option:

Updates that contain fixes and improvements to existing Windows functionality: will be installed immediately
These are quality updates (security updates, non-security fixes). The policy shows "Quality update deferral period (days): 0". This means quality updates are installed as soon as they are released, with no deferral.

Updates that contain new Windows functionality will be installed within: 30 days
These are feature updates (new Windows versions, e.g., Windows 11 24H2). The policy shows "Feature update deferral period (days): 30". This means feature updates will be installed 30 days after Microsoft releases them.

Incorrect Option (for first statement):

can be deferred for 30 days – Incorrect; quality updates have 0 days deferral, not 30 days.

can be deferred indefinitely – Incorrect; deferral periods are finite (0-365 days).

can be deferred for 30 days (alternative) – Same as above, incorrect.

Incorrect Option (for second statement):

1 day – Incorrect; feature deferral is 30 days, not 1 day.

60 days – Incorrect; feature deferral is 30 days, not 60 days.

Reference:
Microsoft Learn: Windows Update rings in Intune – Quality update deferral vs Feature update deferral. No external links provided.

Explanation:
The exhibit shows Active hours start at 8 AM and end at 5 PM, meaning restarts are blocked during working hours (8 AM to 5 PM). The Deadline for quality updates is 2 days, and Grace period is 1 day. A restart will be forced 2 days (deadline) after the update is available, plus the grace period is for user delay, not for forcing restart.

Correct Option:

Automatic restarts are blocked: between 8 AM and 5 PM
Active hours define the period when automatic restarts for updates are blocked. With Active hours start at 8 AM and end at 5 PM, restarts will not occur between 8 AM and 5 PM. Restarts can occur outside these hours (e.g., at 6 PM or 2 AM).

A restart will be forced on a device: 2 days after the deadline
Wait, careful: The "Deadline for quality updates" is 2 days. This means the update must be installed within 2 days of availability. After the deadline expires, a restart will be forced. The grace period (1 day) allows users to postpone restart, but the forced restart occurs after the deadline (2 days) if the user has not already restarted. So the correct answer is 2 days.

Incorrect Option (for first statement):

before 8 AM – Incorrect; restarts can occur before 8 AM (outside active hours).

after 5 PM – Incorrect; restarts can occur after 5 PM (outside active hours).

Incorrect Option (for second statement):

5 days – Incorrect; deadline is 2 days, not 5 days.

1 day – Incorrect; this is the grace period, not the deadline.

Reference:
Microsoft Learn: Update rings in Intune – Active hours block restarts; deadlines force updates within specified days. No external links provided.

Explanation:
Microsoft Intune supports VPN profile creation for all three major device platforms: Windows 10/11, Android, and iOS/iPadOS. VPN profiles can be configured using device configuration profiles, with each platform offering different VPN connection types (e.g., IKEv2, L2TP, PPTP, or custom VPN clients).

Correct Option:

E. Windows 10, Android, and iOS
In the Microsoft Intune admin center, navigate to Devices > Configuration profiles > Create profile. For each platform, you can select a VPN profile type. Windows 10 supports built-in VPN (IKEv2, L2TP, PPTP, etc.) and third-party clients. Android supports built-in VPN and per-app VPN. iOS/iPadOS supports built-in VPN (IKEv2, L2TP, Cisco AnyConnect) and per-app VPN. All three platforms are fully supported for VPN profiles.

Incorrect Option:

A. Windows 10 only – Incorrect; Android and iOS also support VPN profiles.

B. Windows 10 and Android only – Incorrect; iOS also supports VPN profiles.

C. Windows 10 and iOS only – Incorrect; Android also supports VPN profiles.

D. Android and iOS only – Incorrect; Windows 10 also supports VPN profiles.

Reference:
Microsoft Learn: VPN profiles in Intune – Supported platforms include Windows 10, Android, and iOS. No external links provided.

Explanation:
To ensure that a device configuration profile applies to only one device (Device1) within a group that contains multiple devices (Group1 with Device1 and Device2), you should use Scope (Tags). Scope tags filter the assignment, but actually the correct mechanism is Applicability Rules or using a filter. However, in Intune, to target a specific device within a group, you would typically use Filters under Assignments. But among the given options, Scope (Tags) is not correct for this purpose. The correct answer should be Applicability Rules if available. Let me re-evaluate.

Correction:
In Intune, to limit profile application to specific devices within an assigned group, you configure Applicability Rules (e.g., device property condition). Scope tags are for RBAC (administrative scoping), not for filtering devices within an assignment. However, the question lists both Scope (Tags) and Applicability Rules. The correct choice is Applicability Rules.

Given the options, D. Applicability Rules is correct. But your provided answer key says C. Please verify the exhibit.
If the answer is C (Scope Tags) – Scope tags are used to restrict which administrators can see or manage the profile, not to filter which devices receive the profile. Therefore, Scope Tags would not achieve "apply to Device1 only."

Correct answer based on Intune functionality:
D. Applicability Rules – Create a rule such as deviceName equals "Device1" so Profile1 only applies to Device1 even though Group1 contains both devices.

Reference:
Microsoft Learn: Applicability rules in Intune – Filter profile assignment based on device properties. No external links provided.

Explanation:
To repurpose a corporate-owned Windows device by returning it to factory default settings, use Fresh Start. To remove only corporate data from a personally-owned Android device and remove the device from Intune when it checks in, use Retire (which removes corporate data and management but keeps personal data intact). Wipe would remove all data (including personal), which is not appropriate for a personally-owned device.

Correct Option:

Device1: Fresh Start
Fresh Start removes all apps, settings, and user data, then reinstalls Windows. It returns the device to a clean factory state, making it ready for repurposing. It also removes the device from Intune. This is specifically designed for Windows devices to prepare them for redeployment.

Device2: Retire
Retire removes corporate data, corporate apps, and management settings from a personally-owned device. It removes the device from Intune but preserves personal data (photos, personal apps, personal emails). This is the appropriate action for BYOD devices to respect user privacy while removing corporate access.

Incorrect Option (for Device1):

Wipe – Wipe performs a full factory reset but is generally used for mobile devices (iOS/Android). For Windows, Fresh Start is preferred as it ensures the device is properly reprovisioned.

Retire – Retire does not reset the device; it only removes management and corporate data. The device remains usable but not repurposed to factory defaults.

Delete – Delete removes the device from Intune but does not wipe or reset the device locally.

Sync – Sync forces the device to check in with Intune; it does not remove data or reset the device.

Incorrect Option (for Device2):

Wipe – Wipe would perform a full factory reset, deleting all personal data (photos, personal accounts) on the personally-owned device. This violates the requirement to remove only corporate data.

Fresh Start – Fresh Start is for Windows devices only, not Android.

Delete – Delete removes the device from Intune but does not remove corporate data from the device itself.

Sync – Sync does not remove data or unenroll the device.

Reference:
Microsoft Learn: Fresh Start for Windows devices – Returns device to factory settings. Retire for personally-owned devices – Removes corporate data only. No external links provided.

Explanation:
App configuration policies for Android Enterprise can apply to different app types, including store apps, line-of-business (LOB) apps, and Managed Google Play apps. However, App1 (Android store app) may not be configurable unless it supports managed configurations. In typical Intune scenarios, app configuration policies are supported for Managed Google Play apps (App3) and LOB apps (App2) when they are designed to accept configuration. Standard public store apps (App1) often do not support managed configurations.

Correct Option:

E. App1, App2, and App3
All three app types can be targeted by an app configuration policy under Android Enterprise, provided the app supports managed configurations. App1 (Android store app) – if the developer has added support for managed configurations. App2 (line-of-business app) – can be configured if it includes a ManagedConfiguration schema. App3 (Managed Google Play store app) – most fully support managed configurations. The question does not specify which apps support configurations, so all are eligible.

However, many MD-102 exams state that app configuration policies on Android Enterprise apply only to Managed Google Play apps (App3) and LOB apps (App2). Therefore, the answer may be D. App2 and App3 only.

Given your answer key (E), I have provided E above. If the exam expects D, please adjust accordingly.

Reference:
Microsoft Learn: App configuration policies for Android Enterprise – Support for Managed Google Play apps and LOB apps. No external links provided.

Explanation:
Policies for Office apps are evaluated by priority (lower number = higher priority). Policy1 (priority 0) applies to Group1. Policy2 (priority 1) applies to Group2. Group2 and Group3 are members of Group1, so User2 (Group2) and User3 (Group3) are also in Group1. Higher priority policy (Policy1) takes precedence over Policy2 for users in multiple groups.

Correct Option (per statement):

Statement 1: When User1 saves a new spreadsheet, the .ods format is used. → Yes
User1 is a member of Group1 and Group2. Policy1 (priority 0) applies to Group1. Policy2 (priority 1) applies to Group2. Policy1 has higher priority (0 < 1), so Policy1 applies. Policy1 sets default file format to OpenDocument Spreadsheet (.ods). Therefore, User1 saves new spreadsheets as .ods.

Statement 2: When User2 saves a new spreadsheet, the .xlsb format is used. → No
User2 is a member of Group2 and also Group1 (since Group2 is a member of Group1). Policy1 (priority 0, Group1) applies to User2. Policy1 has higher priority than Policy2 (which also applies to Group2). Policy1 sets .ods, not .xlsb. Therefore, User2 saves as .ods, not .xlsb. The statement is false.

Statement 3: When User3 saves a new spreadsheet, the .xlsx format is used. → Yes
User3 is a member of Group3, which is a member of Group1. Policy1 (priority 0, Group1) applies to User3. Policy1 sets .ods. However, the statement claims .xlsx is used. If no policy applies to a user, the default Excel format is .xlsx. But Policy1 does apply to User3 (via Group3 membership in Group1), so .ods would be used. Therefore, the statement is false. Wait — the question says "Group2 and Group3 are members of Group1." That means User3 (Group3) is also in Group1. Policy1 applies to Group1, so User3 gets .ods. So Statement 3 should be No.

Corrected answers:

Statement 1: Yes

Statement 2: No

Statement 3: No

Reference:
Microsoft Learn: Policies for Office apps in Intune – Priority order (lower number = higher priority). No external links provided.

Explanation:
Windows Update for Business is supported on Windows 11 Pro, Enterprise, and Education. For the research department requiring 36 months of feature update support, Windows 11 Enterprise (and Education) offers 36 months of support for feature updates, while Pro offers only 24 months.

Correct Option:

Marketing: Windows 11 Pro
Windows Update for Business is supported on Windows 11 Pro, Enterprise, and Education. The marketing department has no requirement for extended feature update support (36 months). Therefore, Windows 11 Pro is the minimum edition that meets the requirement.

Research: Windows 11 Enterprise
Windows 11 Enterprise provides 36 months of support for feature updates (from release date). Windows 11 Pro only provides 24 months. To meet the 36-month feature update support requirement, the minimum edition required is Windows 11 Enterprise (or Education). Pro for Workstations also offers 36 months, but Enterprise is the minimum.

Incorrect Option (for Marketing):
Windows 11 Enterprise – This would work but is not the minimum required edition since Pro also supports Windows Update for Business.

Incorrect Option (for Research):

Windows 11 Pro – Pro only supports feature updates for 24 months, not 36 months.

Windows 11 Pro for Workstations – This edition does support 36 months, but Enterprise is the minimum lower-cost edition that meets the requirement.

Reference:
Microsoft Learn: Windows 11 edition comparison – Feature update support duration: Pro (24 months), Enterprise/Education (36 months). No external links provided.

Explanation:
In Microsoft Intune, custom notifications (such as Notification1) are created under Devices > Compliance > Notifications and assigned to security groups. When assigned to a group containing users (like Group1), the notification is delivered to the user and appears on all their enrolled devices that support push notifications, regardless of the device’s own group membership. Notifications are user-targeted and platform-agnostic in delivery for supported devices (Windows, Android, iOS).

Correct Option:

User1 receives Notification1 on Device1: Yes
User1 is a member of Group1, and Notification1 is assigned to Group1. Since the notification is user-targeted, User1 receives it on all their enrolled devices, including Device1 (Windows 10, member of Group1). The device platform does not prevent delivery in this scenario.

Correct Option:

User2 receives Notification1 on Device2: No
User2 belongs to Group2, while Notification1 is assigned only to Group1. Therefore, User2 does not receive the notification on any device, including Device2 (Android, member of Group1). Group membership of the device itself is irrelevant when the notification targets a user group.

Correct Option:

User1 receives Notification1 on Device3: Yes
User1 is in Group1 (the target of Notification1). The notification follows the user and is delivered on all their enrolled devices, including Device3 (iOS, member of Group2). Device group membership does not block user-targeted notifications.

Incorrect Option:
Any other combination (e.g., assuming Device group membership controls notifications or that platform limits delivery) is wrong. Notifications in Intune for compliance or custom messages are delivered based on user group assignment, not device group. The device simply needs to be enrolled and online to receive the push notification for that user.

Reference:
Microsoft Learn documentation on Intune compliance notifications and policy assignments.

Explanation:
Microsoft Tunnel Gateway requires Windows Server 2019 or later (2022 is supported) with the Remote Access role installed. The server must be a member server (not domain controller). The Tunnel Gateway uses HTTPS (TCP port 443) for client connections. UDP 443 is used for DTLS-based tunneling. TCP 1723 (PPTP) is not required.

Correct Option:

Server: Server2
Server2 is a member server running Windows Server 2022 with the Remote Access role installed. This meets the Microsoft Tunnel Gateway prerequisites: Windows Server 2019 or later, member server (not domain controller), and Remote Access role (including DirectAccess and VPN). DC1 is a domain controller (not supported), Server1 lacks Remote Access role, Server3 is 2019 but may not have Remote Access role, Server4 is Linux (not supported).

Ports: TCP 443 and UDP 443 only
Microsoft Tunnel uses TCP 443 for HTTPS-based management and connections. UDP 443 is used for DTLS (Datagram Transport Layer Security) to improve performance for real-time traffic. TCP 1723 is for PPTP, which is not used by Microsoft Tunnel. To minimize open ports, only TCP 443 and UDP 443 are required.

Incorrect Option (for Server):

Server1 – Standalone server without Remote Access role; cannot function as Tunnel Gateway.

Server3 – Windows Server 2019 but missing Remote Access role (not stated).

Server4 – RHEL Linux, not supported for Microsoft Tunnel Gateway.

Incorrect Option (for Ports):

TCP 443 only – Missing UDP 443, which is recommended for optimal performance.

TCP 1723 only – PPTP port, not used by Microsoft Tunnel.

TCP 443, TCP 1723, and UDP 443 – Includes unnecessary TCP 1723, not minimizing ports.

Reference:
Microsoft Learn: Microsoft Tunnel Gateway prerequisites – Windows Server 2019/2022, Remote Access role, TCP 443 and UDP 443. No external links provided.

Explanation:
PowerShell remoting (WinRM) requires the user to be a member of the Remote Management Users group on the target computer. This group explicitly grants permission to connect via WinRM (PowerShell remoting, WMI, WS-Management). The principle of least privilege is satisfied because this group provides only remote management access, not full administrative rights.

Correct Option:

D. Remote Management Users
The Remote Management Users group is specifically designed to allow members to access the computer via WinRM (Windows Remote Management). This enables PowerShell remoting without granting full administrator privileges. Adding Admin1 to this group on each target computer allows remote PowerShell connections while following the principle of least privilege.

Incorrect Option:

A. Access Control Assistance Operators –
This group allows users to remotely query authorization attributes of resources but does not grant WinRM or PowerShell remoting access.

B. Remote Desktop Users –
This group allows members to connect via Remote Desktop (RDP, port 3389), not PowerShell remoting (WinRM, port 5985/5986). These are different protocols.

C. Power Users –
This legacy group is largely deprecated and does not specifically grant WinRM access. It provides limited administrative privileges but is not the correct group for PowerShell remoting.

Reference:
Microsoft Learn: Remote Management Users group – Required for WinRM and PowerShell remoting access. No external links provided.