2025 Practice Assessment for Exam MD-102: Endpoint
Administrator Exam Q’s and A’s
You purchase five devices that run Windows 11. Each device contains custom applications.
You need to remove the custom applications from each device. The solution must minimize
administrative effort.
What should you use? - -Windows Configuration Designer
- It is used for creating provisioning packages. One of the options when creating a
provisioning package is to remove preinstalled software.
-You have a Microsoft 365 subscription that uses Windows Autopilot and includes a device
named Device1.
You need to trigger a Windows Autopilot reset on Device1.
What will be retained once the reset has completed? - -Wi-Fi connection details are
retained after an autopilot reset.
- Personal user files are removed during an Autopilot reset and region, language, keyboard,
and modified Windows settings are reset to default during an Autopilot reset.
-You plan to deploy 25 new Windows 11 devices that will be used by customers to browse
the internet in a public location.
You need to recommend a Windows Autopilot mode for the deployment.
What should you recommend? - -Windows Autopilot self-deploying mode
- Only self-deploying mode focusses directly on the kiosk mode requirement in the
question as you can deploy the Kiosk Browser.
-You have a Microsoft 365 subscription that uses Microsoft Intune.
You create a Windows Autopilot deployment profile named Profile1.
You need to manually register a device to test Profile1.
What information can you use to register the device? - -Hardware Hash
- To register a new device in Microsoft Intune you must capture the Hardware Hash
- The MAC address, as a unique identifier, is not required to capture the hardware hash if
you can sign into the device and can use PowerShell.
- The PKID (Windows product ID) and tuple are not valid options to register a new device
to Microsoft Intune or a profile.
-You have a Microsoft 365 E5 subscription that uses Microsoft Intune.
You have the following devices enrolled in Intune:
Device1: Windows 11
Device2: macOS
Device3: iPadOS
You plan to use a template to create an Endpoint Protection device configuration profile in
Intune.
,For which devices can you create an Endpoint Protection device configuration profile
template? - -Device1 and Device2 only
- The Endpoint Protection device configuration template is available only for Windows 10
and later and macOS platforms. This profile is unavailable for iPadOS platform.
-You have a Microsoft 365 subscription that includes a group named Group1 and two
devices named Device1 and Device2.
Device1 runs Windows 10 Enterprise and is a member of Group1. Device2 runs Windows
11 Professional.
You create a new Windows 10 Configuration Profile and configure the following
assignments:
Included Groups: All Devices
Excluded Groups: Group1
You configure the follow applicability rule:
Rule: Assign profile if
Property: OS edition
Value: Windows 10/11 Enterprise
Which devices will receive the profile? - -neither Device1 nor Device2
- Device1 will not receive the profile as it is a member of Group1 which is excluded from
the profile scope.
- Device2 will not receive the profile as it does not meet the Applicability Rules.
-You have a Microsoft 365 subscription that includes 500 Windows 11 devices that are
managed by using Microsoft Intune.
You need to configure the startup page for Microsoft Edge on all devices. The solution must
minimize administrative effort, and support new devices to be included once enrolled.
What should you use? - -a Device Configuration profile
- Only a Device Configuration profile allows you to set the homepage URL.
- The App Configuration settings allow you to create a shortcut, but not the homepage URL.
-You have a Microsoft 365 subscription.
You need to ensure that any Intune managed Windows 10 Device that has been inactive for
180 days is automatically wiped and that the enrollment is deleted from Microsoft Intune.
What should you configure? - -Device Cleanup rules
- Device Cleanup rules can be configured to automatically delete and wipe any device that
has been inactive for a configured period of time between 30 and 270 days.
- Compliance policies measure the compliance of a device against configured criteria and
can mark a device as non-compliant
- Configuration profiles allow settings to be deployed to Intune enrolled devices, but
neither will automatically delete and wipe a device.
, -You have a Microsoft 365 subscription that includes 500 Windows 11 devices that are
managed by using Microsoft Intune.
You need to remove stale devices from the subscription. The solution must minimize
administrative effort.
What should you do? - -Use the bulk device actions to delete the devices.
- In order to remove a stale device from the subscription, you need to use the delete action.
- Retiring a device means it will remove the data, but it will still be visible in Intune.
- Configuring a Device Cleanup rule or creating a Compliance policy will not delete a device
from the subscription.
-You want to ensure that all new Windows 11 devices are joined to Microsoft Entra ID
during the out-of-box experience (OOBE). The IT department has configured the device
registration service and ensured that all necessary prerequisites are met.
You need to join the new Windows 11 devices to Microsoft Entra ID during the OOBE.
Each correct answer presents part of the solution. Which three actions should you
perform? - -1. Turn on the new device and start the setup process.
2. Select 'Set up for work or school' when prompted.
3. Provide the credentials that your organization provided.
- Selecting 'This device belongs to my family' (D) is incorrect as it does not align with the
goal. Skipping the network connection step (E) is incorrect because the device must be
connected to the Internet to complete the Microsoft Entra join.
-Your company is moving to a cloud-first infrastructure and needs to ensure that all
devices accessing its resources comply with security policies. These devices include a mix
of company-owned and personal devices across Windows, iOS, and Android platforms.
You need to implement a solution that allows both types of devices to access organizational
resources while ensuring they meet security compliance.
Each correct answer presents part of the solution. Which three actions should you
perform? - -1. Register user owned devices to Microsoft Entra ID.
2. Enroll devices in Microsoft Intune.
3. Apply Conditional Access policies to enforce compliance.
-You have a Microsoft 365 subscription that includes a user named User1.
You need to ensure that User1 can enroll 150 Windows devices to Microsoft Intune. The
solution must follow the principle of least privilege.
Which role should you assign to User1? - -Device Enrollment Manager
- A Device Enrollment Manager is a non-administrative account that can enroll up to 1000
devices.
- Intune Service Administrators and Global Administrators would be granted more
permissions than required.
Standard users can enroll a maximum of 15 devices.
Administrator Exam Q’s and A’s
You purchase five devices that run Windows 11. Each device contains custom applications.
You need to remove the custom applications from each device. The solution must minimize
administrative effort.
What should you use? - -Windows Configuration Designer
- It is used for creating provisioning packages. One of the options when creating a
provisioning package is to remove preinstalled software.
-You have a Microsoft 365 subscription that uses Windows Autopilot and includes a device
named Device1.
You need to trigger a Windows Autopilot reset on Device1.
What will be retained once the reset has completed? - -Wi-Fi connection details are
retained after an autopilot reset.
- Personal user files are removed during an Autopilot reset and region, language, keyboard,
and modified Windows settings are reset to default during an Autopilot reset.
-You plan to deploy 25 new Windows 11 devices that will be used by customers to browse
the internet in a public location.
You need to recommend a Windows Autopilot mode for the deployment.
What should you recommend? - -Windows Autopilot self-deploying mode
- Only self-deploying mode focusses directly on the kiosk mode requirement in the
question as you can deploy the Kiosk Browser.
-You have a Microsoft 365 subscription that uses Microsoft Intune.
You create a Windows Autopilot deployment profile named Profile1.
You need to manually register a device to test Profile1.
What information can you use to register the device? - -Hardware Hash
- To register a new device in Microsoft Intune you must capture the Hardware Hash
- The MAC address, as a unique identifier, is not required to capture the hardware hash if
you can sign into the device and can use PowerShell.
- The PKID (Windows product ID) and tuple are not valid options to register a new device
to Microsoft Intune or a profile.
-You have a Microsoft 365 E5 subscription that uses Microsoft Intune.
You have the following devices enrolled in Intune:
Device1: Windows 11
Device2: macOS
Device3: iPadOS
You plan to use a template to create an Endpoint Protection device configuration profile in
Intune.
,For which devices can you create an Endpoint Protection device configuration profile
template? - -Device1 and Device2 only
- The Endpoint Protection device configuration template is available only for Windows 10
and later and macOS platforms. This profile is unavailable for iPadOS platform.
-You have a Microsoft 365 subscription that includes a group named Group1 and two
devices named Device1 and Device2.
Device1 runs Windows 10 Enterprise and is a member of Group1. Device2 runs Windows
11 Professional.
You create a new Windows 10 Configuration Profile and configure the following
assignments:
Included Groups: All Devices
Excluded Groups: Group1
You configure the follow applicability rule:
Rule: Assign profile if
Property: OS edition
Value: Windows 10/11 Enterprise
Which devices will receive the profile? - -neither Device1 nor Device2
- Device1 will not receive the profile as it is a member of Group1 which is excluded from
the profile scope.
- Device2 will not receive the profile as it does not meet the Applicability Rules.
-You have a Microsoft 365 subscription that includes 500 Windows 11 devices that are
managed by using Microsoft Intune.
You need to configure the startup page for Microsoft Edge on all devices. The solution must
minimize administrative effort, and support new devices to be included once enrolled.
What should you use? - -a Device Configuration profile
- Only a Device Configuration profile allows you to set the homepage URL.
- The App Configuration settings allow you to create a shortcut, but not the homepage URL.
-You have a Microsoft 365 subscription.
You need to ensure that any Intune managed Windows 10 Device that has been inactive for
180 days is automatically wiped and that the enrollment is deleted from Microsoft Intune.
What should you configure? - -Device Cleanup rules
- Device Cleanup rules can be configured to automatically delete and wipe any device that
has been inactive for a configured period of time between 30 and 270 days.
- Compliance policies measure the compliance of a device against configured criteria and
can mark a device as non-compliant
- Configuration profiles allow settings to be deployed to Intune enrolled devices, but
neither will automatically delete and wipe a device.
, -You have a Microsoft 365 subscription that includes 500 Windows 11 devices that are
managed by using Microsoft Intune.
You need to remove stale devices from the subscription. The solution must minimize
administrative effort.
What should you do? - -Use the bulk device actions to delete the devices.
- In order to remove a stale device from the subscription, you need to use the delete action.
- Retiring a device means it will remove the data, but it will still be visible in Intune.
- Configuring a Device Cleanup rule or creating a Compliance policy will not delete a device
from the subscription.
-You want to ensure that all new Windows 11 devices are joined to Microsoft Entra ID
during the out-of-box experience (OOBE). The IT department has configured the device
registration service and ensured that all necessary prerequisites are met.
You need to join the new Windows 11 devices to Microsoft Entra ID during the OOBE.
Each correct answer presents part of the solution. Which three actions should you
perform? - -1. Turn on the new device and start the setup process.
2. Select 'Set up for work or school' when prompted.
3. Provide the credentials that your organization provided.
- Selecting 'This device belongs to my family' (D) is incorrect as it does not align with the
goal. Skipping the network connection step (E) is incorrect because the device must be
connected to the Internet to complete the Microsoft Entra join.
-Your company is moving to a cloud-first infrastructure and needs to ensure that all
devices accessing its resources comply with security policies. These devices include a mix
of company-owned and personal devices across Windows, iOS, and Android platforms.
You need to implement a solution that allows both types of devices to access organizational
resources while ensuring they meet security compliance.
Each correct answer presents part of the solution. Which three actions should you
perform? - -1. Register user owned devices to Microsoft Entra ID.
2. Enroll devices in Microsoft Intune.
3. Apply Conditional Access policies to enforce compliance.
-You have a Microsoft 365 subscription that includes a user named User1.
You need to ensure that User1 can enroll 150 Windows devices to Microsoft Intune. The
solution must follow the principle of least privilege.
Which role should you assign to User1? - -Device Enrollment Manager
- A Device Enrollment Manager is a non-administrative account that can enroll up to 1000
devices.
- Intune Service Administrators and Global Administrators would be granted more
permissions than required.
Standard users can enroll a maximum of 15 devices.
